I tested the same watch that use log for action and it was triggering so I remove the log and replace it with notify-slack but did not get any notification to the slack channel.
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"indices": [
"logstash*"
],
"body": {
"query": {
"bool": {
"must": [
{ "match": { "log": "*error*" }},
{ "range": { "@timestamp": {
"gte": "now-1m",
"lte": "now" }}}
]
}
},
"_source": [
"kubernetes.container_name",
"kubernetes.host",
"log"
],
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"throttle_period": "5m",
"actions": {
"notify-slack" : {
"throttle_period" : "5m",
"slack" : {
"message" : {
"to" : [ "#channel_name", "@username" ],
"text" : "Encountered {{ctx.payload.hits.total}} errors in the last 5 minutes (facepalm)"
}
}
}
}
}
In the elaticsearch.yml file the slack notification is set,
xpack.notification.slack.account.monitoring.url: https://hooks.slack.com/services/my_webhook.../.../...
I executed the watch and did not get any error and the slack channel is not getting the notification.
I have look at all the es-master and did not see any reference to the watch.
How do I debug or get the log if the watch is executing correctly?