Introduction to Watcher

Transcript

1. INTRODUCTION TO WATCHER ALERTING AND NOTIFICATIONS FOR ELASTICSEARCH Shaunak Kashyap • @shaunak
2. WHY WATCHER?
3. Elasticsearch plugin Highly available Simple API Easy to get started Can integrate with Shield $ b i n / p l u g i n - i e l a s t i c s e a r c h / l i c e n s e / l a t e s t $ b i n / p l u g i n - i e l a s t i c s e a r c h / w a t c h e r / l a t e s t
4. ANATOMY OF A WATCH P U T / _ w a t c h e r / w a t c h / { n a m e - o f - w a t c h } { " t r i g g e r " : . . . , " i n p u t " : . . . , " c o n d i t i o n " : . . . , " a c t i o n s " : . . . }
5. P U T / _ w a t c h e r / w a t c h / { n a m e - o f - w a t c h } { " t r i g g e r " : { " s c h e d u l e " : { " i n t e r v a l " : " 1 0 s " } } , " i n p u t " : . . . , " c o n d i t i o n " : . . . , " a c t i o n s " : . . . } Other types of schedule triggers available are c r o n , h o u r l y , d a i l y , w e e k l y , m o n t h l y , and y e a r l y
6. P U T / _ w a t c h e r / w a t c h / { n a m e - o f - w a t c h } { " t r i g g e r " : . . . , " i n p u t " : { " s e a r c h " : { " r e q u e s t " : { " i n d i c e s " : [ " t i c k e t s " ] , " t y p e s " : [ " t i c k e t " ] , " b o d y " : { " q u e r y " : { " m a t c h _ a l l " : { } } } } } } , " c o n d i t i o n " : . . . , " a c t i o n s " : . . . } Other types of inputs available are s i m p l e , and h t t p
7. P U T / _ w a t c h e r / w a t c h / { n a m e - o f - w a t c h } { " t r i g g e r " : . . . , " i n p u t " : . . . , " c o n d i t i o n " : { " c o m p a r e " : { " c t x . p a y l o a d . h i t s . t o t a l " : { " g t e " : 5 } } } , " a c t i o n s " : . . . } Other types of conditions available are s c r i p t , a l w a y s , and n e v e r
8. P U T / _ w a t c h e r / w a t c h / { n a m e - o f - w a t c h } { " t r i g g e r " : . . . , " i n p u t " : . . . , " c o n d i t i o n " : . . . , " a c t i o n s " : { " e m a i l _ a d m i n i s t r a t o r " : { " t h r o t t l e _ p e r i o d " : " 1 5 m " , " e m a i l " : { " t o " : " s y s . a d m i n @ h o s t . d o m a i n " , " s u b j e c t " : " E n c o u n t e r e d { { c t x . p a y l o a d . h i t s . t o t a l } } e r r o r s " , " b o d y " : " T o o m a n y e r r o r i n t h e s y s t e m , s e e a t t a c h e d d a t a " , " a t t a c h _ d a t a " : t r u e } } } } Other types of actions available are w e b h o o k , i n d e x , and l o g g i n g
10. QUESTIONS? https://discuss.elastic.co/