mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-03-01 16:39:11 +00:00
Docs: Improve watcher action condition docs (elastic/x-pack-elasticsearch#2909)
The action condition feature was carefully hidden in an example. This commit creates an own paragraph to highlight this feature better. Original commit: elastic/x-pack-elasticsearch@006318787b
This commit is contained in:
parent
2693c6a730
commit
4d265868b8
@ -92,7 +92,6 @@ buildRestTests.expectedUnconvertedCandidates = [
|
|||||||
'en/rest-api/security/authenticate.asciidoc',
|
'en/rest-api/security/authenticate.asciidoc',
|
||||||
'en/rest-api/watcher/stats.asciidoc',
|
'en/rest-api/watcher/stats.asciidoc',
|
||||||
'en/security/authorization.asciidoc',
|
'en/security/authorization.asciidoc',
|
||||||
'en/watcher/actions.asciidoc',
|
|
||||||
'en/watcher/example-watches/watching-time-series-data.asciidoc',
|
'en/watcher/example-watches/watching-time-series-data.asciidoc',
|
||||||
]
|
]
|
||||||
|
|
||||||
|
@ -1,7 +1,7 @@
|
|||||||
[[actions]]
|
[[actions]]
|
||||||
== Actions
|
== Actions
|
||||||
|
|
||||||
When a watch's condition is met, it's actions are executed unless it is being
|
When a watch's condition is met, its actions are executed unless it is being
|
||||||
<<actions-ack-throttle, throttled>>. A watch can perform multiple actions.
|
<<actions-ack-throttle, throttled>>. A watch can perform multiple actions.
|
||||||
The actions are executed one at a time and each action executes independently.
|
The actions are executed one at a time and each action executes independently.
|
||||||
Any failures encountered while executing an action are recorded in the
|
Any failures encountered while executing an action are recorded in the
|
||||||
@ -104,13 +104,21 @@ defined in the watch:
|
|||||||
PUT _xpack/watcher/watch/log_event_watch
|
PUT _xpack/watcher/watch/log_event_watch
|
||||||
{
|
{
|
||||||
"trigger" : {
|
"trigger" : {
|
||||||
...
|
"schedule" : { "interval" : "5m" }
|
||||||
},
|
},
|
||||||
"input" : {
|
"input" : {
|
||||||
...
|
"search" : {
|
||||||
|
"request" : {
|
||||||
|
"indices" : "log-events",
|
||||||
|
"body" : {
|
||||||
|
"size" : 0,
|
||||||
|
"query" : { "match" : { "status" : "error" } }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
},
|
},
|
||||||
"condition" : {
|
"condition" : {
|
||||||
...
|
"compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
|
||||||
},
|
},
|
||||||
"throttle_period" : "15m", <1>
|
"throttle_period" : "15m", <1>
|
||||||
"actions" : {
|
"actions" : {
|
||||||
@ -130,9 +138,6 @@ PUT _xpack/watcher/watch/log_event_watch
|
|||||||
}
|
}
|
||||||
},
|
},
|
||||||
"notify_pager" : {
|
"notify_pager" : {
|
||||||
"condition": { <2>
|
|
||||||
"compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
|
|
||||||
}
|
|
||||||
"webhook" : {
|
"webhook" : {
|
||||||
"method" : "POST",
|
"method" : "POST",
|
||||||
"host" : "pager.service.domain",
|
"host" : "pager.service.domain",
|
||||||
@ -144,11 +149,10 @@ PUT _xpack/watcher/watch/log_event_watch
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
--------------------------------------------------
|
--------------------------------------------------
|
||||||
|
// CONSOLE
|
||||||
|
|
||||||
<1> There will be at least 15 minutes between subsequent action executions
|
<1> There will be at least 15 minutes between subsequent action executions
|
||||||
(applies to both `email_administrator` and `notify_pager` actions)
|
(applies to both `email_administrator` and `notify_pager` actions)
|
||||||
<2> A `condition` that only applies to the `notify_pager` action, which
|
|
||||||
restricts its execution to when the condition succeeds (at least 6 hits in this case).
|
|
||||||
|
|
||||||
If you do not define a throttle period at the action or watch level, the global
|
If you do not define a throttle period at the action or watch level, the global
|
||||||
default throttle period is applied. Initially, this is set to 5 seconds. To
|
default throttle period is applied. Initially, this is set to 5 seconds. To
|
||||||
@ -187,6 +191,74 @@ of a watch during its execution:
|
|||||||
|
|
||||||
image::images/action-throttling.jpg[align="center"]
|
image::images/action-throttling.jpg[align="center"]
|
||||||
|
|
||||||
|
|
||||||
|
[[action-conditions]]
|
||||||
|
=== Adding conditions to actions
|
||||||
|
|
||||||
|
When a watch is triggered, its condition determines whether or not to execute the
|
||||||
|
watch actions. Within each action, you can also add a condition per action. These
|
||||||
|
additional conditions enable a single alert to execute different actions depending
|
||||||
|
on a their respective conditions. The following watch would alway send an email, when
|
||||||
|
hits are found from the input search, but only trigger the `notify_pager` action when
|
||||||
|
there are more than 5 hits in the search result.
|
||||||
|
|
||||||
|
[source,js]
|
||||||
|
--------------------------------------------------
|
||||||
|
PUT _xpack/watcher/watch/log_event_watch
|
||||||
|
{
|
||||||
|
"trigger" : {
|
||||||
|
"schedule" : { "interval" : "5m" }
|
||||||
|
},
|
||||||
|
"input" : {
|
||||||
|
"search" : {
|
||||||
|
"request" : {
|
||||||
|
"indices" : "log-events",
|
||||||
|
"body" : {
|
||||||
|
"size" : 0,
|
||||||
|
"query" : { "match" : { "status" : "error" } }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"condition" : {
|
||||||
|
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 } }
|
||||||
|
},
|
||||||
|
"actions" : {
|
||||||
|
"email_administrator" : {
|
||||||
|
"email" : {
|
||||||
|
"to" : "sys.admino@host.domain",
|
||||||
|
"subject" : "Encountered {{ctx.payload.hits.total}} errors",
|
||||||
|
"body" : "Too many error in the system, see attached data",
|
||||||
|
"attachments" : {
|
||||||
|
"attached_data" : {
|
||||||
|
"data" : {
|
||||||
|
"format" : "json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"priority" : "high"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"notify_pager" : {
|
||||||
|
"condition": { <1>
|
||||||
|
"compare" : { "ctx.payload.hits.total" : { "gt" : 5 } }
|
||||||
|
},
|
||||||
|
"webhook" : {
|
||||||
|
"method" : "POST",
|
||||||
|
"host" : "pager.service.domain",
|
||||||
|
"port" : 1234,
|
||||||
|
"path" : "/{{watch_id}}",
|
||||||
|
"body" : "Encountered {{ctx.payload.hits.total}} errors"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
--------------------------------------------------
|
||||||
|
// CONSOLE
|
||||||
|
|
||||||
|
<1> A `condition` that only applies to the `notify_pager` action, which
|
||||||
|
restricts its execution to when the condition succeeds (at least 5 hits in this case).
|
||||||
|
|
||||||
include::actions/email.asciidoc[]
|
include::actions/email.asciidoc[]
|
||||||
|
|
||||||
include::actions/webhook.asciidoc[]
|
include::actions/webhook.asciidoc[]
|
||||||
|
@ -25,6 +25,9 @@ including the watch payload (`ctx.payload.*`). The <<condition-script, script>>,
|
|||||||
conditions can use the payload data to determine whether or not the necessary
|
conditions can use the payload data to determine whether or not the necessary
|
||||||
conditions are met.
|
conditions are met.
|
||||||
|
|
||||||
|
In addition to the watch wide condition, you can also configure conditions
|
||||||
|
per <<action-conditions, action>>.
|
||||||
|
|
||||||
include::condition/always.asciidoc[]
|
include::condition/always.asciidoc[]
|
||||||
|
|
||||||
include::condition/never.asciidoc[]
|
include::condition/never.asciidoc[]
|
||||||
@ -34,7 +37,3 @@ include::condition/compare.asciidoc[]
|
|||||||
include::condition/array-compare.asciidoc[]
|
include::condition/array-compare.asciidoc[]
|
||||||
|
|
||||||
include::condition/script.asciidoc[]
|
include::condition/script.asciidoc[]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user