Run a watch
Generally available
All methods and paths for this operation:
This API can be used to force execution of the watch outside of its triggering logic or to simulate the watch execution for debugging purposes.
For testing and debugging purposes, you also have fine-grained control on how the watch runs. You can run the watch without running all of its actions or alternatively by simulating them. You can also force execution by ignoring the watch condition and control whether a watch record would be written to the watch history after it runs.
You can use the run watch API to run watches that are not yet registered by specifying the watch definition inline. This serves as great tool for testing and debugging your watches prior to adding them to Watcher.
When Elasticsearch security features are enabled on your cluster, watches are run with the privileges of the user that stored the watches.
If your user is allowed to read index a, but not index b, then the exact same set of rules will apply during execution of a watch.
When using the run watch API, the authorization data of the user that called the API will be used as a base, instead of the information who stored the watch. Refer to the external documentation for examples of watch execution requests, including existing, customized, and inline watches.
Required authorization
- Cluster privileges:
manage_watcher
Body
-
Determines how to handle the watch actions as part of the watch execution.
-
When present, the watch uses this object as a payload instead of executing its own input.
-
When set to
true, the watch execution uses the always condition. This can also be specified as an HTTP parameter.Default value is
false. -
When set to
true, the watch record representing the watch execution result is persisted to the.watcher-historyindex for the current time. In addition, the status of the watch is updated, possibly throttling subsequent runs. This can also be specified as an HTTP parameter.Default value is
false. -
This structure is parsed as the data of the trigger event that will be used during the watch execution.
-
When present, this watch is used instead of the one specified in the request. This watch is not persisted to the index and
record_executioncannot be set.
POST _watcher/watch/my_watch/_execute
{
"trigger_data" : {
"triggered_time" : "now",
"scheduled_time" : "now"
},
"alternative_input" : {
"foo" : "bar"
},
"ignore_condition" : true,
"action_modes" : {
"my-action" : "force_simulate"
},
"record_execution" : true
}resp = client.watcher.execute_watch(
id="my_watch",
trigger_data={
"triggered_time": "now",
"scheduled_time": "now"
},
alternative_input={
"foo": "bar"
},
ignore_condition=True,
action_modes={
"my-action": "force_simulate"
},
record_execution=True,
)const response = await client.watcher.executeWatch({
id: "my_watch",
trigger_data: {
triggered_time: "now",
scheduled_time: "now",
},
alternative_input: {
foo: "bar",
},
ignore_condition: true,
action_modes: {
"my-action": "force_simulate",
},
record_execution: true,
});response = client.watcher.execute_watch(
id: "my_watch",
body: {
"trigger_data": {
"triggered_time": "now",
"scheduled_time": "now"
},
"alternative_input": {
"foo": "bar"
},
"ignore_condition": true,
"action_modes": {
"my-action": "force_simulate"
},
"record_execution": true
}
)$resp = $client->watcher()->executeWatch([
"id" => "my_watch",
"body" => [
"trigger_data" => [
"triggered_time" => "now",
"scheduled_time" => "now",
],
"alternative_input" => [
"foo" => "bar",
],
"ignore_condition" => true,
"action_modes" => [
"my-action" => "force_simulate",
],
"record_execution" => true,
],
]);curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"trigger_data":{"triggered_time":"now","scheduled_time":"now"},"alternative_input":{"foo":"bar"},"ignore_condition":true,"action_modes":{"my-action":"force_simulate"},"record_execution":true}' "$ELASTICSEARCH_URL/_watcher/watch/my_watch/_execute"{
"trigger_data" : {
"triggered_time" : "now",
"scheduled_time" : "now"
},
"alternative_input" : {
"foo" : "bar"
},
"ignore_condition" : true,
"action_modes" : {
"my-action" : "force_simulate"
},
"record_execution" : true
}{
"action_modes" : {
"action1" : "force_simulate",
"action2" : "skip"
}
}{
"watch" : {
"trigger" : { "schedule" : { "interval" : "10s" } },
"input" : {
"search" : {
"request" : {
"indices" : [ "logs" ],
"body" : {
"query" : {
"match" : { "message": "error" }
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"log_error" : {
"logging" : {
"text" : "Found {{ctx.payload.hits.total}} errors in the logs"
}
}
}
}
}{
"_id": "my_watch_0-2015-06-02T23:17:55.124Z",
"watch_record": {
"@timestamp": "2015-06-02T23:17:55.124Z",
"watch_id": "my_watch",
"node": "my_node",
"messages": [],
"trigger_event": {
"type": "manual",
"triggered_time": "2015-06-02T23:17:55.124Z",
"manual": {
"schedule": {
"scheduled_time": "2015-06-02T23:17:55.124Z"
}
}
},
"state": "executed",
"status": {
"version": 1,
"execution_state": "executed",
"state": {
"active": true,
"timestamp": "2015-06-02T23:17:55.111Z"
},
"last_checked": "2015-06-02T23:17:55.124Z",
"last_met_condition": "2015-06-02T23:17:55.124Z",
"actions": {
"test_index": {
"ack": {
"timestamp": "2015-06-02T23:17:55.124Z",
"state": "ackable"
},
"last_execution": {
"timestamp": "2015-06-02T23:17:55.124Z",
"successful": true
},
"last_successful_execution": {
"timestamp": "2015-06-02T23:17:55.124Z",
"successful": true
}
}
}
},
"input": {
"simple": {
"payload": {
"send": "yes"
}
}
},
"condition": {
"always": {}
},
"result": {
"execution_time": "2015-06-02T23:17:55.124Z",
"execution_duration": 12608,
"input": {
"type": "simple",
"payload": {
"foo": "bar"
},
"status": "success"
},
"condition": {
"type": "always",
"met": true,
"status": "success"
},
"actions": [
{
"id": "test_index",
"index": {
"response": {
"index": "test",
"version": 1,
"created": true,
"result": "created",
"id": "AVSHKzPa9zx62AzUzFXY"
}
},
"status": "success",
"type": "index"
}
]
},
"user": "test_admin"
}
}