Getting Started
editGetting Started
editThis getting started guide walks you through installing Watcher and creating your first watches, and introduces the building blocks you’ll use to create custom watches. You must run the version of Watcher that matches the version of Elasticsearch you are running.
To install and run Watcher:
-
Run
bin/plugin install
fromES_HOME
to install the License plugin:bin/plugin install license
You need to install the License and Watcher plugins on each node in your cluster.
-
Run
bin/plugin install
to install the Watcher plugin.bin/plugin install watcher
If you are using a DEB/RPM distribution of Elasticsearch, run the installation with superuser permissions. To perform an offline installation, download the Watcher binaries.
-
Confirm that you want to grant Watcher additional permissions. Watcher needs these permissions to set the threat context loader during install so it can send email notifications.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: plugin requires additional permissions @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ * java.lang.RuntimePermission getClassLoader * java.lang.RuntimePermission setContextClassLoader * java.lang.RuntimePermission setFactory See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html for descriptions of what these permissions allow and the associated risks. Continue with installation? [y/N]y
Specify the
--batch
option when running the install command to automatically grant these permissions and bypass this install prompt. -
If you have disabled automatic index creation in Elasticsearch, configure
action.auto_create_index
inelasticsearch.yml
to allow Watcher to create the.watches
,.triggered_watches
, and.watcher-history*
indices:action.auto_create_index: .watches,.triggered_watches,.watcher-history*
If you have Shield installed, you must also allow Shield to create the
.security
index. -
Start Elasticsearch.
bin/elasticsearch
-
To verify that Watcher is set up, call the Watcher
_stats
API:curl -XGET 'http://localhost:9200/_watcher/stats?pretty'
You haven’t set up any watches yet, so the
watch_count
is zero and theexecution_thread_pool
queue is empty:{ "watcher_state": "started", "watch_count": 0, "execution_thread_pool": { "queue_size": 0, "max_size": 0 } }
Ready to start building watches? Choose one of the following scenarios: