Watcher API - ACK with Action Conditions

Hello all,

I have been building a Watcher that has a transform and then any number of actions dependent upon user input. I want to make it to where a user can ACK a specific action in order to allow throttling.

The way I have configured the watcher is there is a generalized condition that just checks the initial payload from the input, then that payload is sent through the transform and each action has a condition attached that checks this transformed payload to see if the action can execute or not.

THE QUESTION
If a user has ACK'd a specific action, would the state of the Watcher go back to await_successful_execution when the overall condition is met or only if that specific action's condition is met?

I have attempted testing this and it would seem that even if I were to ACK a specific action, if the overall condition is met, the state of the watcher is set back to awaits_successful_execution when it would be better if it would stay in the acked state until the specific action's condition is met. It could be I am just doing something wrong but after reading through documentation, I am a bit confused.

Here is my Watcher with some information scraped out/replaced:

{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "myIndex"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 10000,
          "_source": {
            "includes": [
              "displayname",
              "location_name",
              "hostname",
              "status"
            ]
          },
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "enabled": 1
                  }
                },
                {
                  "match": {
                    "status": 0
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m",
                      "lte": "now"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "ctx['payload']['hits']['hits'].size() > 0",
      "lang": "painless"
    }
  },
  "transform": {
    "script": {
      "id": "myTransformScript"
    }
  },
  "metadata": {
    "comment": "metadata has a lot of parameters that are used throughout this watcher, but they are business sensitive, so these are omitted as they do not pertain to the question."
  },
  "actions": {
    "email": {
      "condition": {
        "script": {
          "source": "ctx['payload']['total'] > 0",
          "lang": "painless"
        }
      },
      "email": {
        "profile": "standard",
        "attachments": {
          "data.json": {
            "data": {
              "format": "json"
            }
          }
        },
        "to": [
          "someEmail@gmail.com"
        ],
        "subject": "You got a problem!",
        "body": {
          "html": {
            "id": "mustacheTemplateForEmail"
          }
        }
      }
    }
  }
}

Here is the way I am ACKing the email:
POST _watcher/watch/myWatcher/_ack/email

If further clarification is needed, I can provide that. Thank you ahead of time for any help given!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.