Watcher mutilple actions and conditions

Elastic Stack Elasticsearch
1

Hi Team ,

I am using watcher for calling webhook and email , it is working perfectly fine .
But i need to apply one more condition and depending on that condition i want to call different email which is different from first one . I want to check if data is coming in metricbeat or not . where to add second condition and it's action ?
Please find below working watcher script

PUT _watcher/watch/sajal
{
"trigger" : {
"schedule" : { "interval" : "1m" }
},
"input" : {
"search": {
"request": {
"indices": "metricbeat-*",
"body": {
"query": {
"bool": {
"must": [
{ "match":
{ "system.filesystem.mount_point":"/u02"}
},
{ "range":
{ "system.filesystem.used.pct":{"gte": "0.70"}
}
}
],
"filter": [
{ "range": { "@timestamp": {
"from": "now-60s",
"to": "now"

}
}
}
]
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email_administrator" : {
"email" : {
"to" : "Sajal_Sachan@Dellteam.com",
"subject" : "Encountered {{ctx.payload.hits.total}} errors",
"body" : "Error in the system, see attached data",
"priority" : "high"
}
}
}
}

2

Hey,

so instead of using a compare condition you can use a script condition. Scripting allows you to check arbitrary things based on whatever logic you have in mind and thus is extremely customizable.

Regarding the recipient: Within your condition you could add an additional snippet, that sets a field like ctx.payload.email_recipient = "foo@bar" - and of course you can set the recipient based on any if condition you like within your script. This would allow you to set "to" : "{{ctx.payload.email_recipient}}" in your email and have a dynamic recipient.

Hope this helps!

--Alex

3

Thanks Alex,

Can you just help me in below requirement ?

I want to check if data is not coming in metricbeat index . So i want to place condition ctx.payload.hits.total" : { "eq" : 0 } . And when this condition mets then it should call another email saying metricbeat data is not coming .
I want to add this part in working watcher script . How i should add this part ?

4

hey.

what about two watches? one with a condition check for zero hits and one with another check then running different actions?

--Alex

5

I want to use only single watch . Is that possible ?

6

it is possible by specifying a condition for each action. I'd personally not do it though to keep a single watch more readable.

7

By creating two watcher , impact on CPU will be double or it will be same as if we use two conditions in same watcher ?

8

Hi Alexander ,

Can you please help me to add other condition in same watcher ?

I want to check if data is not coming in metricbeat index . So i want to place condition ctx.payload.hits.total" : { "eq" : 0 } . And when this condition mets then it should call another email saying metricbeat data is not coming .
Working watcher script is given in above messages. Please help me to add other condition in same watcher .

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.