Watcher's State - Error!

Elastic Stack Elasticsearch
1

I just noticed that several of X-Pack Monitoring watcher's state is:

Error!

w/ comment

Execution Failing

Please advise.

2

Hey Alexus, can you tell me what the name of the failing watch is? Thanks.

CJ

3

Error:

  • X-Pack Monitoring: Cluster Status
  • X-Pack Monitoring: Nodes Changed
  • X-Pack Monitoring: Kibana Version Mismatch
  • X-Pack Monitoring: Logstash Version Mismatch

OK:

  • X-Pack Monitoring: Elasticsearch Version Mismatch
  • X-Pack Monitoring: License Expiration

I also created several other "watch", one executes without any issues and rest shows blank in "Last Triggered"

4

OK, so one of the watches which is failing is the elasticsearch_cluster_status watch. Could you execute this watch and share the output with me? You can run the watch like this:

POST /_xpack/watcher/watch/${cluster_uuid}_elasticsearch_cluster_status/_execute

The UUID should be visible in the Watches table, or you can get it from the _id value of the response from GET /.watches/_search?_source=_id.

Thanks,
CJ

5

@cjcenizal pretty sure I wouldn't be able to paste my answer here, so I pastebin it instead)

6

Well, that's odd. That looks like a healthy watch. Could you share a screenshot of your watches table, showing the failed watches?

7

42%20PM
Screenshot 2018-02-09 at 11.08.42 PM.png1347×187 35 KB

8

some moon shot from the current information: do you have an email account configured in your alerting setup, that maybe is not set up properly?

--Alex

9

for moon shot... it's like bullseyes)

my setup is testing environment, I'll try to configure email account and see if that resolves my issue...

10

would it be also possible to share the output of the watcher history for one of your watches where the run was failed?

Thanks a lot!

11

@spinscale, can you provide curl command?

12

If you only have the monitoring watches installed, you can just run this

GET .watcher-history-*/_search
{
  "sort": [
    {
      "result.execution_time": {
        "order": "desc"
      }
    }
  ]
}

might be too much output to put here, so please put it into a gist/pastebin or something.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.