Watcher mutilple actions and conditions

[Sajal (Sajal Sachan)]

Hi Team ,

I am using watcher for calling webhook and email , it is working perfectly fine .
But i need to apply one more condition and depending on that condition i want to call different email which is different from first one . I want to check if data is coming in metricbeat or not . where to add second condition and it's action ?
Please find below working watcher script

PUT _watcher/watch/sajal
{
"trigger" : {
"schedule" : { "interval" : "1m" }
},
"input" : {
"search": {
"request": {
"indices": "metricbeat-*",
"body": {
"query": {
"bool": {
"must": [
{ "match":
{ "system.filesystem.mount_point":"/u02"}
},
{ "range":
{ "system.filesystem.used.pct":{"gte": "0.70"}
}
}
],
"filter": [
{ "range": { "@timestamp": {
"from": "now-60s",
"to": "now"

}
}
}
]
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email_administrator" : {
"email" : {
"to" : "Sajal_Sachan@Dellteam.com",
"subject" : "Encountered {{ctx.payload.hits.total}} errors",
"body" : "Error in the system, see attached data",
"priority" : "high"
}
}
}
}

[spinscale (Alexander Reelsen)]

Hey,

so instead of using a compare condition you can use a script condition. Scripting allows you to check arbitrary things based on whatever logic you have in mind and thus is extremely customizable.

Regarding the recipient: Within your condition you could add an additional snippet, that sets a field like ctx.payload.email_recipient = "foo@bar" - and of course you can set the recipient based on any if condition you like within your script. This would allow you to set "to" : "{{ctx.payload.email_recipient}}" in your email and have a dynamic recipient.

Hope this helps!

--Alex

[Sajal (Sajal Sachan)]

Thanks Alex,

Can you just help me in below requirement ?

I want to check if data is not coming in metricbeat index . So i want to place condition ctx.payload.hits.total" : { "eq" : 0 } . And when this condition mets then it should call another email saying metricbeat data is not coming .
I want to add this part in working watcher script . How i should add this part ?

[spinscale (Alexander Reelsen)]

hey.

what about two watches? one with a condition check for zero hits and one with another check then running different actions?

--Alex

[Sajal (Sajal Sachan)]

I want to use only single watch . Is that possible ?

[spinscale (Alexander Reelsen)]

it is possible by specifying a condition for each action. I'd personally not do it though to keep a single watch more readable.

[Sajal (Sajal Sachan)]

By creating two watcher , impact on CPU will be double or it will be same as if we use two conditions in same watcher ?

[Sajal (Sajal Sachan)]

Hi Alexander ,

Can you please help me to add other condition in same watcher ?

I want to check if data is not coming in metricbeat index . So i want to place condition ctx.payload.hits.total" : { "eq" : 0 } . And when this condition mets then it should call another email saying metricbeat data is not coming .
Working watcher script is given in above messages. Please help me to add other condition in same watcher .