Watcher with no data in logs

Elastic Stack Kibana
1

Hello!

I have a question on condition in watcher. How can I make a condition for triggering a watcher in case there are no data in the logs?
I have a watcher to send notifications if http codes 200 less than 5.
how to make the watcher send a notification according to two conditions: if 200 codes are less than 5 and if 200 codes are not in the logs at all for a certain period of time? (there are no documents in the logs at all)

2

Hi @kurdit. I think you could use a script condition that accesses the watch payload similar to this one but include an OR (||) operator in the script. Something like this.

{...
      "source" : "return ctx.payload.hits.total < 5 || ctx.payload.hits.total == 0",
...}