Watcher recovery action

Elastic Stack Elasticsearch
1

I am using the following watch definition. It's pretty simple, just sends an email when the cluster is red:

curl -XPUT 'http://localhost:9200/_watcher/watch/cluster_health_watch' -d '{
"trigger" : {
  "schedule" : { "interval" : "10s" }
},
"input" : {
  "http" : {
    "request" : {
     "host" : "localhost",
     "port" : 9200,
     "path" : "/_cluster/health"
    }
  }
},
"condition" : {
  "compare" : {
    "ctx.payload.status" : { "eq" : "red" }
  }
},
"actions" : {
  "send_email" : {
    "email" : {
      "to" : "me@me.com",
      "subject" : "Elasticsearch ERROR - Cluster status is RED",
      "body" : "Cluster status is RED"
    }
  }
 }
}'

I'd like to receive a follow up email when the state turns back to green stating "Recovery" or something similar. I only want that email action when the state of the cluster has gone from red to green.

Is this possible? Thanks!

2

Heya,

I could imagine a chained input here. One that is getting the current cluster state and the other is querying the watch history and gets the most recent state. This would allow you to compare those two and trigger and email then.

--Alex