Worked nicely! For cases like mine (data coming from logstash) perhaps docs could add a line or two regarding index to be used in watches!
Thanks.
great to hear that it all works now. We actually do have an example of how you can use watcher with LS:
https://www.elastic.co/guide/en/watcher/current/watching-time-series-data.html
perhaps we need to make it more obvious.
Thx for the feedback