Enable Watcher

Watcher lets you take action based on changes in your data. It is designed around the principle that, if you can query something in Elasticsearch, you can alert on it. Simply define a query, condition, schedule, the actions to take, and Watcher will do the rest.

Watcher can be enabled when configuring your cluster. You can run Alerting on a separate cluster from the cluster whose data you are actually watching.

Some restrictions apply when adding alerts. To learn more, check Restrictions for alerts (via Watcher).

To enable Watcher on a cluster, you may first need to perform one or several of the following steps. The options shown in the UI differ between stack versions; if an option is not available, you can skip it.

To learn more about Kibana alerting and how to use it, check Alerting and Actions.

Alerting can send alerts by email. You can configure notifications similar to the operational emails that Elasticsearch Service sends automatically to alert you about performance issues in your clusters.

Watcher in Elastic Cloud is preconfigured with an email service and can be used without any additional configuration. Alternatively, a custom mail server can be configured as described in Configuring a custom mail server

You can optionally add HTML sanitization settings under Elasticsearch User settings in the Elasticsearch Service Console so that HTML elements are sanitized in the email notification.

For more information on sending alerts by email, check Email action.

The following quotas apply when using the Elastic email service:

Under the hood, Alerting is configured through elasticsearch.yml. If you want to customize your Alerting settings, you can provide custom elasticsearch.yml snippet which is appended to your configuration.

To provide the custom snippet, you can use the console Elasticsearch settings editor for your deployment.

For example if you want to use the Slack integration:

There are three steps to integrate Elasticsearch with Slack:

To add a webhook in Slack, select the settings icon, then choose Add an app and search for webhook.

The following example shows a configuration with multiple Slack accounts (account1, account2, and account3) specified in elasticsearch.yml:

xpack.notification.slack:
  default_account: account1
  account:
    account1:
      message_defaults:
        from: account1
        to: channel1
    account2:
      message_defaults:
        from: account2
        to: channel2
    account3:
      message_defaults:
        from: account3
        to: channel3

The Slack Webhook is set for each account in the Elasticsearch Keystore with the following settings:

If you have a Slack account that is not currently set as default_account, and you want to use this account for a Watcher Alert, you must create an Advanced Watch and explicitly define in the Actions section of the UI which Slack account to use.

PUT _watcher/watch/test-alarm
{
  "metadata" : {
    ...
  },
  "trigger" : {
    ...
  },
  "input" : {
    ...
  },
  "actions" : {
    "notify-slack" : {
      "throttle_period" : "10s",
      "slack" : {
        "account" : "account2",
        "message" : {
          "to" : [ "#testing-channel" ],
          "text" : "You Know, for Search"
        }
      }
    }
  }
}

In Elasticsearch versions before 7.0:, you are not required to use the Elasticsearch keystore. Instead, you can use the console Elasticsearch settings editor for your deployment.

It is possible to use a custom mail service instead of the one configured by default. It can be configured by following the Elasticsearch documentation for configuring email accounts.

An example on how to configure a new account from the Elastic cloud console:

For a full reference of all available settings, see the Elasticsearch documentation.