Use watchers to manage indices and get watcher data into visualisations


I have two questions:

  1. Is it possible to use watchers to create/delete indices?

  2. How could I get into a visualisation?
    In the discovery tab it says that there is no cached mapping for that field, but refreshing the index pattern doesn't help.


  1. Yes, you can use the webhook action to do that.
  2. This is not possible. In order to find out why, you should take a look at the watch history index template (just use GET _template to check it out. The payload field is never indexed, because it can be highly dynamic and thus cause a mapping explosion as well as cause invalid mappings (one watch has a payload that has a fieldname with a string, the other with an integer) - that's why it is disabled.

Hope this helps!


Hey Alex,

Thank you for the fast reply.
I'll check out the webhook action.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.