[root@elk01 ~]# curl -XPUT 'http://127.0.0.1:9200/_watcher/watch/log_error_watch' -d '{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "logs" ],
"body" : {
"query" : {
"match" : { "message": "error" }
}
}
}
}
}
}'
{"error":{"root_cause":[{"type":"invalid_index_name_exception","reason":"Invalid index name [_watcher], must not start with '_', '-', or '+'","index_uuid":"_na_","index":"_watcher"}],"type":"invalid_index_name_exception","reason":"Invalid index name [_watcher], must not start with '_', '-', or '+'","index_uuid":"_na_","index":"_watcher"},"status":400}
[root@elk01 ~]#
We are using Kibana 4.6 and ES 2.4 and looking to set up alerting on our data from Heartbeat, Metricbeat and Filebeat.