Francois-Clement Brossard renshuki

This watcher trigger an alert when less than 80% of page responses are under 500ms. (Time range not present in the sample below and need to be added )

Index sample

POST latency/_doc
{
  "response_time": 100
}

Curator configuration

curator.yml

client:
  hosts:
    - https://your_cluster_url.cloud.es.io
  port: 9243
 use_ssl: True

slowlogs is the name of the index

PUT slowlogs/_settings
{
  "index": {
    "search": {
      "slowlog": {
        "level": "warn",
 "threshold": {

PUT _cluster/settings
{
  "persistent": {
    "xpack": {
      "monitoring": {
        "collection": {
          "enabled": "true",
          "interval": "10s"
 },

curl -XPOST -u elastic:password "http://localhost:5601/api/saved_objects/index-pattern/my-index-pattern-*" \
-H "Content-Type: application/json" \
-H "kbn-xsrf: true" -d '
{
  "attributes": {
    "title": "my-index-pattern-*"
  }
}
'

Slowlog thresholds for all indices

Add slowlog thresholds for all indices

PUT /_all/_settings 
{
"index.search.slowlog.threshold.query.warn": "10s",
"index.search.slowlog.threshold.query.info": "5s",
"index.search.slowlog.threshold.query.debug": "2s",

This watcher check every 5 minutes if the number of Logstash monitoring events are below 1 which means Logstash monitoring is in trouble.

"watch" : {
    "trigger" : {
      "schedule" : {
        "interval" : "5m"
      }
    },
    "input" : {

	[Unit]
	Description=Elasticsearch
	Documentation=http://www.elastic.co
	Wants=network-online.target
	After=network-online.target

	[Service]
	RuntimeDirectory=elasticsearch
	PrivateTmp=true
	Environment=ES_HOME=/usr/share/elasticsearch

	[Unit]
	Description=logstash

	[Service]
	Type=simple
	User=logstash
	Group=logstash
	# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
	# Prefixing the path with '-' makes it try to load, but if the file doesn't
	# exist, it continues onward.

	[Unit]
	Description=Kibana
	StartLimitIntervalSec=30
	StartLimitBurst=3

	[Service]
	Type=simple
	User=kibana
	Group=kibana
	# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.