Hi Team ,
I am using watcher for calling webhook and email , it is working perfectly fine .
But i need to apply one more condition and depending on that condition i want to call different email which is different from first one . I want to check if data is coming in metricbeat or not . where to add second condition and it's action ?
Please find below working watcher script
PUT _watcher/watch/sajal
{
"trigger" : {
"schedule" : { "interval" : "1m" }
},
"input" : {
"search": {
"request": {
"indices": "metricbeat-*",
"body": {
"query": {
"bool": {
"must": [
{ "match":
{ "system.filesystem.mount_point":"/u02"}
},
{ "range":
{ "system.filesystem.used.pct":{"gte": "0.70"}
}
}
],
"filter": [
{ "range": { "@timestamp": {
"from": "now-60s",
"to": "now"
}
}
}
]
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email_administrator" : {
"email" : {
"to" : "Sajal_Sachan@Dellteam.com",
"subject" : "Encountered {{ctx.payload.hits.total}} errors",
"body" : "Error in the system, see attached data",
"priority" : "high"
}
}
}
}