Watcher - Only Alert Once Based on Specific Field

Elastic Stack Kibana
1

Hello,

So I understand scheduling a csv report is only possible currently with Watcher.
My use case is I want to send a csv report based on user.name when a condition has been met.

The issue is the condition will be met more than once. I want to know how Watcher can alert only once based on user.name, and even though the condition is still being met, to not alert after the first time.

Thanks,
Erik

2

@alisongoryachev can this user get some help please?

Thanks,
Bhavya

3

Hi @erikg! I don't think there is a way to achieve this OOTB. I would recommend looking into leveraging a Painless script.

Docs: Watcher condition context | Painless Scripting Language [8.13] | Elastic

This is also a similar post with suggestions: Alert Notification just once

1 Like
4

Hey @alisongoryachev , thanks!

I will look into this, is there any plans to add this capability as a built-in feature?