WARNING: Version 6.1 of the Elastic Stack has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Triggers Conditions »
Elastic Docs ›X-Pack for the Elastic Stack [6.1] ›Alerting on Cluster and Index Events ›Triggers

Schedule Trigger

edit

Schedule Trigger

edit

Schedule triggers define when the watch execution should start based on date and time. All times are specified in UTC time.

Watcher uses the system clock to determine the current time. To ensure schedules are triggered when expected, you should synchronize the clocks of all nodes in the cluster using a time service such as NTP.

Keep in mind that the throttle period can affect when a watch is actually executed. The default throttle period is five seconds (5000 ms). If you configure a schedule that’s more frequent than the throttle period, the throttle period overrides the schedule. For example, if you set the throttle period to one minute (60000 ms) and set the schedule to every 10 seconds, the watch is executed no more than once per minute. For more information about throttling, see Acknowledgement and Throttling.

Watcher provides several types of schedule triggers:

Hourly Schedule

edit

A schedule that triggers at a particular minute every hour of the day. To use the hourly schedule, you specify the minute (or minutes) when you want the scheduler to start the watch execution with the minute attribute.

If you don’t specify the minute attribute for an hourly schedule, it defaults to 0 and the schedule triggers on the hour every hour--12:00, 13:00, 14:00, and so on.

Configuring a Once an Hour Schedule

edit

To configure a once an hour schedule, you specify a single time with the minute attribute.

For example, the following hourly schedule triggers at minute 30 every hour-- 12:30, 13:30, 14:30, …​:

{
  "trigger" : {
    "schedule" : {
      "hourly" : { "minute" : 30 }
    }
  }
}

Configuring a Multiple Times Hourly Schedule

edit

To configure an hourly schedule that triggers at multiple times during the hour, you specify an array of minutes. For example, the following schedule triggers every 15 minutes every hour--12:00, 12:15, 12:30, 12:45, 1:00, 1:15, …​:

{
  "trigger" : {
    "schedule" : {
      "hourly" : { "minute" : [ 0, 15, 30, 45 ] }
    }
  }
}

Daily Schedule

edit

A schedule that triggers at a particular time every day. To use the daily schedule, you specify the time of day (or times) when you want the scheduler to start the watch execution with the at attribute.

Times are specified in the form HH:mm on a 24-hour clock. You can also use the reserved values midnight and noon for 00:00 and 12:00, and specify times using objects.

If you don’t specify the at attribute for a daily schedule, it defaults to firing once daily at midnight, 00:00.

Configuring a Daily Schedule

edit

To configure a once a day schedule, you specify a single time with the at attribute. For example, the following daily schedule triggers once every day at 5:00 PM:

{
  "trigger" : {
    "schedule" : {
      "daily" : { "at" : "17:00" }
    }
  }
}

Configuring a Multiple Times Daily Schedule

edit

To configure a daily schedule that triggers at multiple times during the day, you specify an array of times. For example, the following daily schedule triggers at 00:00, 12:00, and 17:00 every day.

{
  "trigger" : {
    "schedule" : {
      "daily" : { "at" : [ "midnight", "noon", "17:00" ] }
    }
  }
}

Specifying Times Using Objects

edit

In addition to using the HH:mm string syntax to specify times, you can specify a time as an object that has hour and minute attributes.

For example, the following daily schedule triggers once every day at 5:00 PM:

{
  "trigger" : {
    "schedule" : {
      "daily" : {
        "at" {
          "hour" : 17,
          "minute" : 0
        }
      }
    }
  }
}

To specify multiple times using the object notation, you specify multiple hours or minutes as an array. For example, following daily schedule triggers at 00:00, 00:30, 12:00, 12:30, 17:00 and 17:30 every day:

{
  "trigger" : {
    "schedule" : {
      "daily" : {
        "at" {
          "hour" : [ 0, 12, 17 ],
          "minute" : [0, 30]
        }
      }
    }
  }
}

Weekly Schedule

edit

A schedule that triggers at a specific day and time every week. To use the weekly schedule, you specify the day and time (or days and times) when you want the scheduler to start the watch execution with the on and at attributes.

You can specify the day of the week by name, abbreviation, or number (with Sunday being the first day of the week):

  • sunday, monday, tuesday, wednesday, thursday, friday and saturday
  • sun, mon, tue, wed, thu, fri and sat
  • 1, 2, 3, 4, 5, 6 and 7

Times are specified in the form HH:mm on a 24-hour clock. You can also use the reserved values midnight and noon for 00:00 and 12:00.

Configuring a Weekly Schedule

edit

To configure a once a week schedule, you specify the day with the on attribute and the time with the at attribute. For example, the following weekly schedule triggers once a week on Friday at 5:00 PM:

{
  "trigger" : {
    "schedule" : {
      "weekly" : { "on" : "friday", "at" : "17:00" }
    }
  }
}

You can also specify the day and time with the day and time attributes, they are interchangeable with on and at.

Configuring a Multiple Times Weekly Schedule

edit

To configure a weekly schedule that triggers multiple times a week, you can specify an array of day and time values. For example, the following weekly schedule triggers every Tuesday at 12:00 PM and every Friday at 5:00 PM:

{
  "trigger" : {
    "schedule" : {
      "weekly" : [
        { "on" : "tuesday", "at" : "noon" },
        { "on" : "friday", "at" : "17:00" }
      ]
    }
  }
}

Alternatively, you can specify days and times in an object that has on and minute attributes that contain an array of values. For example, the following weekly schedule triggers every Tuesday and Friday at 12:00 PM and 17:00 PM:

{
  "trigger" : {
    "schedule" : {
      "weekly" : {
        "on" : [ "tuesday", "friday" ],
        "at" : [ "noon", "17:00" ]
      }
    }
  }
}

Monthly Schedule

edit

A schedule that triggers at a specific day and time every month. To use the monthly schedule, you specify the day of the month and time (or days and times) when you want the scheduler to start the watch execution with the on and at attributes.

You specify the day of month as a numeric value between 1 and 31 (inclusive). Times are specified in the form HH:mm on a 24-hour clock. You can also use the reserved values midnight and noon for 00:00 and 12:00.

Configuring a Monthly Schedule

edit

To configure a once a month schedule, you specify a single day and time with the on and at attributes. For example, the following monthly schedule triggers on the 10th of each month at noon:

{
  "trigger" : {
    "schedule" : {
      "monthly" : { "on" : 10, "at" : "noon" }
    }
  }
}

You can also specify the day and time with the day and time attributes, they are interchangeable with on and at.

Configuring a Multiple Times Monthly Schedule

edit

To configure a monthly schedule that triggers multiple times a month, you can specify an array of day and time values. For example, the following monthly schedule triggers at 12:00 PM on the 10th of each month and at 5:00 PM on the 20th of each month:

{
  "trigger" : {
    "schedule" : {
      "monthly" : [
        { "on" : 10, "at" : "noon" },
        { "on" : 20, "at" : "17:00" }
      ]
    }
  }
}

Alternatively, you can specify days and times in an object that has on and at attributes that contain an array of values. For example, the following monthly schedule triggers at 12:00 AM and 12:00 PM on the 10th and 20th of each month.

{
  "trigger" : {
    "schedule" : {
      "monthly" : {
        "on" : [ 10, 20 ],
        "at" : [ "midnight", "noon" ]
      }
    }
  }
}

Yearly Schedule

edit

A schedule that triggers at a specific day and time every year. To use the yearly schedule, you specify the month, day, and time (or months, days, and times) when you want the scheduler to start the watch execution with the in, on, and at attributes.

You can specify the month by name, abbreviation, or number:

  • january, february, march, april, may, june, july, august, september, october, november and december
  • jan, feb, mar, apr, may, jun, jul, aug, sep, oct, nov and dec
  • 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 and 12

You specify the day of month as a numeric value between 1 and 31 (inclusive). The Times are specified in the form HH:mm on a 24-hour clock. You can also use the reserved values midnight and noon for 00:00 and 12:00.

Configuring a Yearly Schedule

edit

To configure a once a year schedule, you specify the month with the in attribute, the day with the on attribute, and the time with the at attribute. For example, the following yearly schedule triggers once a year at noon on January 10th:

{
  "trigger" : {
    "schedule" : {
      "yearly" : { "in" : "january", "on" : 10, "at" : "noon" }
    }
  }
}

You can also specify the month, day, and time with the month, day, and time attributes, they are interchangeable with in, on, and at.

Configuring a Multiple Times Yearly Schedule

edit

To configure a yearly schedule that triggers multiple times a year, you can specify an array of month, day, and time values. For example, the following yearly schedule triggers twice a year: at noon on January 10th, and at 5:00 PM on July 20th.

{
  "trigger" : {
    "schedule" : {
      "yearly" : [
        { "in" : "january", "on" : 10, "at" : "noon" },
        { "in" : "july", "on" : 20, "at" : "17:00" }
      ]
    }
  }
}

Alternatively, you can specify the months, days, and times in an object that has in, on, and minute attributes that contain an array of values. For example, the following yearly schedule triggers at 12:00 AM and 12:00 PM on January 10th, January 20th, December 10th, and December 20th.

{
  "trigger" : {
    "schedule" : {
      "yearly" : {
        "in" : [ "jan", "dec" ],
        "on" : [ 10, 20 ],
        "at" : [ "midnight", "noon" ]
      }
    }
  }
}

cron Schedule

edit

A schedule trigger that enables you to use a cron style expression to specify when you want the scheduler to start the watch execution. Watcher uses the cron parser from the Quartz Job Scheduler. For more information about writing Quartz cron expressions, see the Quartz CronTrigger Tutorial.

While cron triggers are super powerful, we recommend using one of the other schedule types if you can, as they are much more straightforward to configure. If you use cron, construct your cron expressions with care to be sure you are actually setting the schedule you want. You can use the croneval tool to validate your cron expressions and see what the resulting trigger times will be.

Cron Expressions

edit

A cron expression is a string of the following form:

    <seconds> <minutes> <hours> <day_of_month> <month> <day_of_week> [year]

All elements are required except for year. Table 22, “Cron Expression Elements” shows the valid values for each element in a cron expression.

Table 22. Cron Expression Elements

Name Required Valid Values Valid Special Characters

seconds

yes

0-59

, - * /

minutes

yes

0-59

, - * /

hours

yes

0-23

, - * /

day_of_month

yes

1-31

, - * / ? L W

month

yes

1-12 or JAN-DEC

, - * /

day_of_week

yes

1-7 or SUN-SAT

, - * / ? L #

year

no

empty or 1970-`2099

, - * /

The special characters you can use in a cron expression are described in Table 23, “Cron Special Characters”. The names of months and days of the week are not case sensitive. For example, MON and mon are equivalent.

Currently, you must specify ? for either the day_of_week or day_of_month. Explicitly specifying both values is not supported.

Table 23. Cron Special Characters

Special Character Description

*

All values. Selects every possible value for a field. For example, * in the hours field means "every hour".

?

No specific value. Use when you don’t care what the value is. For example, if you want the schedule to trigger on a particular day of the month, but don’t care what day of the week that happens to be, you can specify ? in the day_of_week field.

-

A range of values (inclusive). Use to separate a minimum and maximum value. For example, if you want the schedule to trigger every hour between 9:00 AM and 5:00 PM, you could specify 9-17 in the hours field.

,

Multiple values. Use to separate multiple values for a field. For example, if you want the schedule to trigger every Tuesday and Thursday, you could specify TUE,THU in the day_of_week field.

/

Increment. Use to separate values when specifying a time increment. The first value represents the starting point, and the second value represents the interval. For example, if you want the schedule to trigger every 20 minutes starting at the top of the hour, you could specify 0/20 in the minutes field. Similarly, specifying 1/5 in day_of_month field will trigger every 5 days starting on the first day of the month.

L

Last. Use in the day_of_month field to mean the last day of the month—​day 31 for January, day 28 for February in non-leap years, day 30 for April, and so on. Use alone in the day_of_week field in place of 7 or SAT, or after a particular day of the week to select the last day of that type in the month. For example 6L means the last Friday of the month. You can specify LW in the day_of_month field to specify the last weekday of the month. Avoid using the L option when specifying lists or ranges of values, as the results likely won’t be what you expect.

W

Weekday. Use to specify the weekday (Monday-Friday) nearest the given day. As an example, if you specify 15W in the day_of_month field and the 15th is a Saturday, the schedule will trigger on the 14th. If the 15th is a Sunday, the schedule will trigger on Monday the 16th. If the 15th is a Tuesday, the schedule will trigger on Tuesday the 15th. However if you specify 1W as the value for day_of_month, and the 1st is a Saturday, the schedule will trigger on Monday the 3rd—​it won’t jump over the month boundary. You can specify LW in the day_of_month field to specify the last weekday of the month. You can only use the W option when the day_of_month is a single day—​it is not valid when specifying a range or list of days.

#

Nth XXX day in a month. Use in the day_of_week field to specify the nth XXX day of the month. For example, if you specify 6#1, the schedule will trigger on the first Friday of the month. Note that if you specify 3#5 and there are not 5 Tuesdays in a particular month, the schedule won’t trigger that month.

Table 24. Setting Daily Triggers

Cron Expression Description

0 5 9 * * ?

Trigger at 9:05 AM every day.

0 5 9 * * ? 2015

Trigger at 9:05 AM every day during the year 2015.

Table 25. Restricting Triggers to a Range of Days or Times

Cron Expression Description

0 5 9 ? * MON-FRI

Trigger at 9:05 AM Monday through Friday.

0 0-5 9 * * ?

Trigger every minute starting at 9:00 AM and ending at 9:05 AM every day.

Table 26. Setting Interval Triggers

Cron Expression Description

0 0/15 9 * * ?

Trigger every 15 minutes starting at 9:00 AM and ending at 9:45 AM every day.

0 5 9 1/3 * ?

Trigger at 9:05 AM every 3 days every month, starting on the first day of the month.

Table 27. Setting Schedules that Trigger on a Particular Day

Cron Expression Description

0 1 4 1 4 ?

Trigger every April 1st at 4:01 AM.

0 0,30 9 ? 4 WED

Trigger at 9:00 AM and at 9:30 AM every Wednesday in the month of April.

0 5 9 15 * ?

Trigger at 9:05 AM on the 15th day of every month.

0 5 9 15W * ?

Trigger at 9:05 AM on the nearest weekday to the 15th of every month.

0 5 9 ? * 6#1

Trigger at 9:05 AM on the first Friday of every month.

Table 28. Setting Triggers Using Last

Cron Expression Description

0 5 9 L * ?

Trigger at 9:05 AM on the last day of every month.

0 5 9 ? * 2L

Trigger at 9:05 AM on the last Monday of every month

0 5 9 LW * ?

Trigger at 9:05 AM on the last weekday of every month.

Configuring a Cron Schedule

edit

To configure a cron schedule, you simply specify the cron expression as a string value. For example, the following snippet configures a cron schedule that triggers every day at noon:

{
  ...
  "trigger" : {
    "schedule" : {
      "cron" : "0 0 12 * * ?"
    }
  }
  ...
}

Configuring a Multiple Times Cron Schedule

edit

To configure a cron schedule that triggers multiple times, you can specify an array of cron expressions. For example, the following cron schedule triggers every even minute during weekdays and every uneven minute during the weekend:

{
  ...
  "trigger" : {
    "schedule" : {
      "cron" : [
        "0 0/2 * ? * MON-FRI"",
        "0 1-59/2 * ? * SAT-SUN"
      ]
    }
  }
  ...
}

Verifying Cron Expressions

edit

X-Pack ships with a croneval command line tool that you can use to verify that your cron expressions are valid and produce the expected results. This tool is provided in the $ES_HOME/bin/x-pack directory.

To verify a cron expression, simply pass it in as a parameter to croneval:

bin/x-pack/croneval "0 0/1 * * * ?"

If the cron expression is valid, croneval displays the next 10 times that the schedule will be triggered.

You can specify the -c option to control how many future trigger times are displayed. For example, the following command displays the next 20 trigger times:

bin/x-pack/croneval "0 0/1 * * * ?" -c 20

Interval Schedule

edit

A schedule that triggers at a fixed time interval. The interval can be set in seconds, minutes, hours, days, or weeks:

  • "Xs" - trigger every X seconds. For example, "30s" means every 30 seconds.
  • "Xm" - trigger every X minutes. For example, "5m" means every 5 minutes.
  • "Xh" - trigger every X hours. For example, "12h" means every 12 hours.
  • "Xd" - trigger every X days. For example, "3d" means every 3 days.
  • "Xw" - trigger every X weeks. For example, "2w" means every 2 weeks.

If you don’t specify a time unit, it defaults to seconds.

The interval value differs from the standard time value used in Elasticsearch. You cannot configure intervals in milliseconds or nanoseconds.

Configuring an Interval Schedule

edit

To configure an interval schedule, you specify a string value that represents the interval. If you omit the unit of time (s,m, h, d, or w), it defaults to seconds.

For example, the following interval schedule triggers every five minutes:

{
  "trigger" : {
    "schedule" : {
      "interval" : "5m"
    }
  }
}
« Triggers Conditions »