And this is the entire watcher definition:
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"chain": {
"inputs": [
{
"alert": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": ["watcheralerts"],
"types": [],
"body": {
"query": {
"bool": {
"must": [
{
"term": {
"_id": "{{ctx.metadata.alertid}}"
}
},
{
"term": {
"inAlert": true
}
}
]
}
}
}
}
}
}
},
{
"check": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": ["heartbeat-*"],
"types": [],
"body": {
"query": {
"bool": {
"filter": [
{
"term": {
"monitor.status": {
"value": "down"
}
}
},
{
"range": {
"@timestamp": {
"gte": "now-1m"
}
}
},
{
"term": {
"monitor.name": "{{ctx.metadata.heartbeatname}}"
}
}
]
}
},
"sort": "@timestamp"
}
}
}
}
}
]
}
},
"condition": {
"script": {
"source": "ctx.vars.fails_check = ctx.payload.check.hits.total != 0 && ctx.payload.check.hits.hits[0]._source.monitor.status != 'up'; ctx.vars.not_resolved = ctx.payload.alert.hits.total == 1;if (ctx.vars.fails_check && ctx.vars.not_resolved){return false;} else {return ctx.vars.fails_check || ctx.vars.not_resolved;}",
"lang": "painless"
}
},
"actions": {
"log": {
"transform": {
"script": {
"source": "return ['status': ctx.vars.fails_check ? 'down' : 'up']",
"lang": "painless"
}
},
"logging": {
"level": "info",
"text": "{{ctx.metadata.heartbeatname}} is {{ctx.payload.status}}"
}
},
"slack_1": {
"transform": {
"script": {
"source": "return ['status': ctx.vars.fails_check ? 'down' : 'up']",
"lang": "painless"
}
},
"slack": {
"message": {
"to": ["#web-api-notifications"],
"text": "{{ctx.metadata.heartbeatname}} is {{ctx.payload.status}}"
}
}
},
"index_payload": {
"transform": {
"script": "return [ 'inAlert' : ctx.vars.fails_check ]"
},
"index": {
"index": "{{ctx.metadata.alertindex}}",
"doc_type": "{{ctx.metadata.alerttype}}",
"doc_id": "{{ctx.metadata.alertid}}"
}
}
},
"metadata": {
"heartbeatname": "[CRM] GET /index.html",
"heartbeatindex": "heartbeat-*",
"alertid": "crm_get_index.html",
"alertindex": ".watcheralerts",
"alerttype": "doc",
"tz": "Europe/Oslo"
}
}