Adding conditions to actions

When a watch is triggered, its condition determines whether or not to execute the watch actions. Within each action, you can also add a condition per action. These additional conditions enable a single alert to execute different actions depending on a their respective conditions. The following watch would always send an email, when hits are found from the input search, but only trigger the notify_pager action when there are more than 5 hits in the search result.

  1. PUT _watcher/watch/log_event_watch
  2. {
  3. "trigger" : {
  4. "schedule" : { "interval" : "5m" }
  5. },
  6. "input" : {
  7. "search" : {
  8. "request" : {
  9. "indices" : "log-events",
  10. "body" : {
  11. "size" : 0,
  12. "query" : { "match" : { "status" : "error" } }
  13. }
  14. }
  15. }
  16. },
  17. "condition" : {
  18. "compare" : { "ctx.payload.hits.total" : { "gt" : 0 } }
  19. },
  20. "actions" : {
  21. "email_administrator" : {
  22. "email" : {
  23. "to" : "sys.admino@host.domain",
  24. "subject" : "Encountered {{ctx.payload.hits.total}} errors",
  25. "body" : "Too many error in the system, see attached data",
  26. "attachments" : {
  27. "attached_data" : {
  28. "data" : {
  29. "format" : "json"
  30. }
  31. }
  32. },
  33. "priority" : "high"
  34. }
  35. },
  36. "notify_pager" : {
  37. "condition": {
  38. "compare" : { "ctx.payload.hits.total" : { "gt" : 5 } }
  39. },
  40. "webhook" : {
  41. "method" : "POST",
  42. "host" : "pager.service.domain",
  43. "port" : 1234,
  44. "path" : "/{{watch_id}}",
  45. "body" : "Encountered {{ctx.payload.hits.total}} errors"
  46. }
  47. }
  48. }
  49. }

A condition that only applies to the notify_pager action, which restricts its execution to when the condition succeeds (at least 5 hits in this case).