elasticsearch watcher examples

1PUT _watcher/watch/log_errors
2{
3  "metadata" : { 
4    "color" : "red"
5  },
6  "trigger" : { 
7    "schedule" : {
8      "interval" : "5m"
9    }
10  },
11  "input" : { 
12    "search" : {
13      "request" : {
14        "indices" : "log-events",
15        "body" : {
16          "size" : 0,
17          "query" : { "match" : { "status" : "error" } }
18        }
19      }
20    }
21  },
22  "condition" : { 
23    "compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
24  },
25  "transform" : { 
26    "search" : {
27        "request" : {
28          "indices" : "log-events",
29          "body" : {
30            "query" : { "match" : { "status" : "error" } }
31          }
32        }
33    }
34  },
35  "actions" : { 
36    "my_webhook" : {
37      "webhook" : {
38        "method" : "POST",
39        "host" : "mylisteninghost",
40        "port" : 9200,
41        "path" : "/{{watch_id}}",
42        "body" : "Encountered {{ctx.payload.hits.total}} errors"
43      }
44    },
45    "email_administrator" : {
46      "email" : {
47        "to" : "sys.admino@host.domain",
48        "subject" : "Encountered {{ctx.payload.hits.total}} errors",
49        "body" : "Too many error in the system, see attached data",
50        "attachments" : {
51          "attached_data" : {
52            "data" : {
53              "format" : "json"
54            }
55          }
56        },
57        "priority" : "high"
58      }
59    }
60  }
61}