Watcher send mail if it doesn't meet the requirement

[yasin]

Dear Team,

I want to setup a advanced watcher with:
If it doesn't get the total hits or text message then it needs to send a mail(if possible within a timeframe).
Please help me out with this one.

[bhavyarm]

Hello Yasin

You can do this by using threshold watches with our watcher feature:

You need the default distro of elasticsearch with a valid platinum/gold license after your trial expires to use watcher.

Thanks,
Bhavya

[yasin]

Dear Bhavya

Would first like to thank you for your reply.
When checking the screenshot i've added but i want to do more such as:
GROUPED OVER top 500'cam.routeid.keyword' --> "1.incoming OFP" only and specify for a specific customer. Is that possible?

Note: Can we add slack query in advanced watcher place?

[bhavyarm]

@sebastien can we please get some help here?

I don't think we can filter on a single value yet in matching conditions here?
You can definitely add slack actions on watcher so you will get watch notifications.

Thanks,
Bhavya

[sebastien]

Hello,

Yes I don't think it is not possible to filter on a single value, @Bill_McConaghy can you confirm this?

Cheers

[yasin]

Dear Team,

Trying to figure out in putting it in query but still failed:

      "aggs": {
        "bucketAgg": {
          "terms": {
            "field": "camel.routeId.keyword",
            "size": 500,
            "order": {
              "_count": "desc"
            }
          }

So in field i'm trying to add a value and changed to :

  },
      "aggs": {
        "bucketAgg": {
          "terms": {
            "field": "camel.routeId.keyword:3a. EFF FTP download",
            "size": 500,
            "order": {
              "_count": "desc"
            }

Maybe i can use the prefix?:
https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-prefix-query.html

[yasin]

Please help me out with this one.

[yasin]

Dear Team,

Any suggestions?