NOTE: You are looking at documentation for an older release. For the latest information, see the current release documentation.

« Watching event data Watcher limitations »
Elastic Docs ›Elasticsearch Guide [6.8] ›Alerting on Cluster and Index Events

Troubleshooting Watcher

edit

Troubleshooting Watcher

edit

Dynamic mapping error when trying to add a watch

edit

If you get the Dynamic Mapping is Disabled error when you try to add a watch, verify that the index mappings for the .watches index are available. You can do that by submitting the following request:

GET .watches/_mapping

If the index mappings are missing, follow these steps to restore the correct mappings:

  1. Stop the Elasticsearch node.
  2. Add xpack.watcher.index.rest.direct_access : true to elasticsearch.yml.
  3. Restart the Elasticsearch node.

  4. Delete the .watches index:

    DELETE .watches

  5. Disable direct access to the .watches index:

    1. Stop the Elasticsearch node.
    2. Remove xpack.watcher.index.rest.direct_access : true from elasticsearch.yml.
    3. Restart the Elasticsearch node.

Unable to send email

edit

If you get an authentication error indicating that you need to continue the sign-in process from a web browser when Watcher attempts to send email, you need to configure Gmail to Allow Less Secure Apps to access your account.

If you have two-step verification enabled for your email account, you must generate and use an App Specific password to send email from Watcher. For more information, see:

Watcher not responsive

edit

Keep in mind that there’s no built-in validation of scripts that you add to a watch. Buggy or deliberately malicious scripts can negatively impact Watcher performance. For example, if you add multiple watches with buggy script conditions in a short period of time, Watcher might be temporarily unable to process watches until the bad watches time out.

« Watching event data Watcher limitations »