watcher script sample

get_node_status_1.md

PUT _xpack/watcher/watch/my-watch1
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "http",
        "host": "localhost",
        "port": 9200,
        "method": "get",
        "path": "/_nodes/stats/http",
        "params": {},
        "headers": {},
        "auth": {
          "basic": {
            "username": "elastic",
            "password" : "changeme"
          }
        }
      }
    }
  },
  "condition": {
    "always": {}
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "{{ctx.payload._nodes}} documents in your index. Threshold is 10."
      }
    }
  }
}

POST _xpack/watcher/watch/my-watch1/_execute

get_node_status_2.md

PUT _xpack/watcher/watch/my-watch1
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "http",
        "host": "localhost",
        "port": 9200,
        "method": "get",
        "path": "/_nodes/stats/http",
        "params": {},
        "headers": {},
        "auth": {
          "basic": {
            "username": "elastic",
            "password" : "changeme"
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload._nodes.failed": {
        "gte": 1
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "There are {{ctx.payload._nodes.failed}} unresponsive nodes"
      }
    }
  }
}

POST _xpack/watcher/watch/my-watch1/_execute

logstash_status_watcher.md

# this watcher needs some tweaking because when logstash is down, it won't even repsond to the request defined in input.http.
PUT _xpack/watcher/watch/logstash-monitor
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "http",
        "host": "localhost",
        "port": 9600,
        "path": "/_node/stats/os",
        "auth": {
          "basic": {
            "username": "elastic",
            "password" : "changeme"
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.host" : {
        "eq" : "xxxx"
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "{{ctx.payload.host}} is down"
      }
    }
  }
}

POST _xpack/watcher/watch/logstash-monitor/_execute

super_simple_sample.md

{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "hotel"
        ],
        "types": [],
        "body": {
          "size": 5,
          "query": {
            "match_all": {}
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 10
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "There are {{ctx.payload.hits.total}} sample1 documents in your index.  {{ctx.payload.hits.hits.3._source.hotel_name}} Threshold is 10."
      }
    }
  }
}