- Watcher Reference for 2.x and 1.x:
- Introduction
- Getting Started
- Customizing Watches
- How Watcher Works
- Installing Watcher
- Administering Watcher
- Configuring Watcher to Send Email
- Configuring Watcher to Send Messages to HipChat
- Configuring Watcher to Send Messages to Slack
- Configuring Watcher to Send PagerDuty Events
- Integrating Watcher with Shield
- Integrating Watcher with Logstash
- Configuring the Default Throttle Period
- Configuring the Default HTTP Timeouts
- Configuring the Default Internal Operations Timeouts
- Getting Watcher Statistics
- Monitoring Watch Execution
- Managing Watches
- Example Watches
- Reference
- Managing Your License
- Limitations
- Troubleshooting
- Release Notes
Customizing Actions
editCustomizing Actions
editWatcher supports four types of actions email, index, logging, and webhook.
To use the email action, you need to configure an email account in
elasticsearch.yml that Watcher can use to send email. Your custom email messages can be
plain text or styled using HTML. You can include information from the watch payload using
templates, as well as attach the entire watch payload to the message. For example,
the following email action uses a template in the subject line and attaches the payload data to the
message.
"actions" : { "send_email" : { "email" : { "to" : "<username>@<domainname>", "subject" : "Watcher Notification", "body" : "{{ctx.payload.hits.total}} watches took more than 2.5 seconds to execute.", "attachments" : { "data_attachments" : { "data" : { "format" : "json" } } } } } }
The index action enables you to load data from the watch payload into an Elasticsearch index. The
entire payload can be indexed as a single document, or you can use a transform to populate a
_doc field with an array of objects that are indexed as separate documents.
The logging action enables you to add entries to the Elasticsearch logs, which is useful
during development and testing. For example, the following logging action logs the number
of watches that took longer than 2.5 seconds to run.
"actions" : { "log" : { "logging" : { "text" : "{{ctx.payload.hits.total}} watches took more than 2.5 seconds to execute" } } }
The webhook action enables you to submit a request to any external webservice. For example,
the following webhook action creates a Pagerduty trigger event.
"actions" : { "send_trigger" : { "throttle_period" : "5m", "webhook" : { "method" : "POST", "host" : "events.pagerduty.com", "scheme" : "https", "port" : 443, "path": ":/generic/2010-04-15/create_event.json}", "body" : "{ \"service_key\": \"e93facc04764012d7bfb002500d5d1a6\", \"incident_key\": \"long_watches\", \"event_type\": \"trigger\", \"description\": \"{{ctx.payload.hits.total}} watches took more than 2.5 seconds to execute\", \"client\": \"Watcher\" }" "headers": {"Content-type": "application/json"} } } }