This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
Running an action for each element in an array
editRunning an action for each element in an array
editYou can use the foreach field in an action to trigger the configured action
for every element within that array.
In order to protect from long running watches, you can use the max_iterations
field to limit the maximum amount of runs that each watch executes. If this limit
is reached, the execution is gracefully stopped. If not set, this field defaults
to one hundred.
resp = client.watcher.put_watch(
id="log_event_watch",
trigger={
"schedule": {
"interval": "5m"
}
},
input={
"search": {
"request": {
"indices": "log-events",
"body": {
"query": {
"match": {
"status": "error"
}
}
}
}
}
},
condition={
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
actions={
"log_hits": {
"foreach": "ctx.payload.hits.hits",
"max_iterations": 500,
"logging": {
"text": "Found id {{ctx.payload._id}} with field {{ctx.payload._source.my_field}}"
}
}
},
)
print(resp)
const response = await client.watcher.putWatch({
id: "log_event_watch",
trigger: {
schedule: {
interval: "5m",
},
},
input: {
search: {
request: {
indices: "log-events",
body: {
query: {
match: {
status: "error",
},
},
},
},
},
},
condition: {
compare: {
"ctx.payload.hits.total": {
gt: 0,
},
},
},
actions: {
log_hits: {
foreach: "ctx.payload.hits.hits",
max_iterations: 500,
logging: {
text: "Found id {{ctx.payload._id}} with field {{ctx.payload._source.my_field}}",
},
},
},
});
console.log(response);
PUT _watcher/watch/log_event_watch
{
"trigger" : {
"schedule" : { "interval" : "5m" }
},
"input" : {
"search" : {
"request" : {
"indices" : "log-events",
"body" : {
"query" : { "match" : { "status" : "error" } }
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 } }
},
"actions" : {
"log_hits" : {
"foreach" : "ctx.payload.hits.hits",
"max_iterations" : 500,
"logging" : {
"text" : "Found id {{ctx.payload._id}} with field {{ctx.payload._source.my_field}}"
}
}
}
}