# Watcher Rule

**URL:** <https://discuss.elastic.co/t/watcher-rule/311153>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 1, 2022, 6:11pm UTC](https://discuss.elastic.co/t/watcher-rule/311153 "2022-08-01T18:11:20Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [August 1, 2022, 6:11pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/1 "2022-08-01T18:11:20Z")

</div>

I want to do a universal Rule for if All indices fall below a certain threshold , then alert on specific index at question.

How do i specify the Index name in the Body of this watcher request ?

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [August 1, 2022, 7:07pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/2 "2022-08-01T19:07:21Z")

</div>

> [@Elk\_huh](#):
>
> r if All indices fall below a certain threshold , then alert on specific index at question.
> 
> How do i specify the Index name in the Body of this watcher request ?

@Patrick_Mueller - any insights into this ? Does this help ?[Create an index threshold rule | Kibana Guide [master] | Elastic](https://www.elastic.co/guide/en/kibana/master/rule-type-index-threshold.html)

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [August 1, 2022, 7:13pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/3 "2022-08-01T19:13:45Z")

</div>

If you are using Watcher, then you simply wildcard the index names like so:

```auto
...
   "input": {
      "search": {
        "request": {
          "indices": [
            "*"
          ],
...

```

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [August 1, 2022, 7:19pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/4 "2022-08-01T19:19:31Z")

</div>

> [@richcollier](#):
>
> name

Lets say we got index \* ( indexa,indexb,indexc)

In the action --\> i have SMTP how do i say indexA exceeded the threshold

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [August 1, 2022, 7:19pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/5 "2022-08-01T19:19:42Z")

</div>

> [@Elk\_huh](#):
>
> ve S

> [@richcollier](#):
>
> name

Lets say we got index \* ( indexa,indexb,indexc)

In the action --\> i have SMTP how do i say indexA exceeded the threshold

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [August 1, 2022, 7:20pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/6 "2022-08-01T19:20:17Z")

</div>

I just need the index name in the output body

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [August 1, 2022, 7:55pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/7 "2022-08-01T19:55:26Z")

</div>

well, it's more complicated than that because you first have to aggregate the information on the index names, then individually evaluate each of them against your condition (in my example, the condition is if the index has less than 200 documents in the last day). Then, in the actions, you iterate through the result data structure again for formatting purposes. It would look something like this:

```auto
POST _watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "1d"
      }
    },
    "input": {
      "search": {
        "request": {
          "indices": [
            "*"
          ],
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "all_indices": {
                "terms": {
                  "field": "_index",
                  "size": 10000
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "script": """
            for (def indices : ctx.payload.aggregations.all_indices.buckets) {
          	     if (indices.doc_count<200){
                    return true;
          	     }
            }
            """
    },
    "actions": {
      "log": {
        "transform": {
          "script": """
          	def records = new ArrayList();
          	for (def indices : ctx.payload.aggregations.all_indices.buckets) {
          	  def details = new HashMap();
          	     if (indices.doc_count<200){
                    details.put("index",indices.key);
                    details.put("doc_count",indices.doc_count);
                    records.add(details);
          	     }
            }
            return records;
          """
        },
        "logging": {
          "text": """
          Records:
          ==========
          {{#ctx.payload._value}}
          index "{{index}}" had only {{doc_count}} documents
          {{/ctx.payload._value}}
           """
        }
      }
    }
  }
}

```

In my system, the output looks like:

```auto
          Records:
          ==========
          index ".ds-synthetics-http-default-2022.07.27-000001" had only 24 documents
          index ".fleet-policies-leader-7" had only 3 documents
          index ".fleet-servers-7" had only 1 documents

```

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [August 3, 2022, 7:44pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/8 "2022-08-03T19:44:29Z")

</div>

So i should just do individual watchers for each index then ,

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2022, 7:45pm UTC](https://discuss.elastic.co/t/watcher-rule/311153/9 "2022-08-31T19:45:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.