[watcher] - [how to] [monitor] Elasticsearch Snapshots

Elastic Stack Elasticsearch
1

Dear All,

With the help of watcher I would like to be informed when my ES index daily backup failed.

# The idea is to have a configuration like: 
PUT _xpack/watcher/watch/my-daily-backup-alert
{
  "trigger": {},      => every morning
  "input": {},        => snapshot is sucessful and its name match the date of the day
  "condition": {},    => nbr of hits > 0
  "transform": {},
  "actions": {}       => email admin
}

I had a quick look inside the documentation and has chosen to go with "Calling Elasticsearch APIs";

BUT I encountered some difficulties writing the "input" part :confused:

Any advice?

Thanks in advance for you help.
kr,
O.

PUT _xpack/watcher/watch/my-daily-backup-alert
{
  "metadata" : { 
    "color" : "red"
  },
  "trigger" : { 
    "schedule" : {
      "interval" : "55m"
    }
  },
  "input" : {
    "http" : {
      "request" : {
        "host" : "localhost",
        "port" : "9200",
        "path" : "/_snapshot/nfs-repository/_all",
        "params" : {
          "state" : "SUCCESS"
      }
    }
  },
  "condition" : { 
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  },
  "transform" : {
  },
  "actions" : { 
    "email_administrator" : {
      "email" : {
        "to" : "sys.admino@host.domain",
        "subject" : "Encountered {{ctx.payload.hits.total}} errors",
        "body" : "WARNING error(s) during backup, see attached data",
        "attachments" : {
          "attached_data" : {
            "data" : {
              "format" : "json"
            }
          }
        },
        "priority" : "high"
      }
    }
  }
}
2

Hey,

can you be more exact, what you concrete issue is except that you encountered difficulties? What did not work as you expected it to work?

--Alex

3

Hello Alexander, regarding the input part, the syntax I use is not correct ... "port" not recognized :confused:

  {
    "type": "parse_exception",
    "reason": "could not parse http request template. unexpected string field [port]"
  }
4

Hey,

port must be a number, not a string.

--Alex

2 Likes
5

damned! What a stupid mistake :confused: Thanks anyway
I hope this 'discussion' may help others.

ps: Of course this topic can be marked as "closed"

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.