KAAE Watcher Anatomy

Watcher Anatomy

KaaE watchers are modeled after Elasticsearch watchers and share the same configuration structure:

Watcher Structure

• Trigger
  • Schedule
  • Input
    • Search
  • Condition
    • Script
  • Transform
  • Action
    • Actions

Watcher Example

{
  "_index": "watcher",
  "_type": "watch",
  "_id": "new",
  "_source": {
    "trigger": {
      "schedule": {
        "later": "every 5 minutes"
      }
    },
    "input": {
      "search": {
        "request": {
          "indices": [
            "<mos-{now/d}>",
            "<mos-{now/d-1d}>"
          ],
          "body": {}
        }
      }
    },
    "condition": {
      "script": {
        "script": "payload.hits.total > 100"
      }
    },
    "transform": {},
    "actions": {
      "email_admin": {
        "throttle_period": "15m",
        "email": {
          "to": "alarm@localhost",
          "subject": "KaaE Alarm",
          "priority": "high",
          "body": "Found {{payload.hits.total}} Events"
        }
      },
      "slack_admin": {
        "throttle_period": "15m",
        "slack": {
          "channel": "#kaae",
          "message": "KaaE Alert! Found {{payload.hits.total}} Events"
        }
      }
    }
  }
}

More Examples