I am using the following watch definition. It's pretty simple, just sends an email when the cluster is red:
curl -XPUT 'http://localhost:9200/_watcher/watch/cluster_health_watch' -d '{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"http" : {
"request" : {
"host" : "localhost",
"port" : 9200,
"path" : "/_cluster/health"
}
}
},
"condition" : {
"compare" : {
"ctx.payload.status" : { "eq" : "red" }
}
},
"actions" : {
"send_email" : {
"email" : {
"to" : "me@me.com",
"subject" : "Elasticsearch ERROR - Cluster status is RED",
"body" : "Cluster status is RED"
}
}
}
}'
I'd like to receive a follow up email when the state turns back to green stating "Recovery" or something similar. I only want that email action when the state of the cluster has gone from red to green.
Is this possible? Thanks!