Customizing Actions

Watcher supports four types of actions email, index, logging, and webhook.

To use the email action, you need to configure an email account in elasticsearch.yml that Watcher can use to send email. Your custom email messages can be plain text or styled using HTML. You can include information from the watch payload using templates, as well as attach the entire watch payload to the message. For example, the following email action uses a template in the subject line and attaches the payload data to the message.

"actions" : {
  "send_email" : {
    "email" : {
      "to" : "<username>@<domainname>",
      "subject" : "Watcher Notification",
      "body" : "{{ctx.payload.hits.total}} watches took more than 2.5 seconds to execute.",
      "attachments" : {
        "data_attachments" : {
          "data" : {
            "format" : "json"
          }
        }
      }
    }
  }
}

The index action enables you to load data from the watch payload into an Elasticsearch index. The entire payload can be indexed as a single document, or you can use a transform to populate a _doc field with an array of objects that are indexed as separate documents.

The logging action enables you to add entries to the Elasticsearch logs, which is useful during development and testing. For example, the following logging action logs the number of watches that took longer than 2.5 seconds to run.

"actions" : {
  "log" : {
    "logging" : {
      "text" : "{{ctx.payload.hits.total}} watches took more than 2.5 seconds to execute"
    }
  }
}

The webhook action enables you to submit a request to any external webservice. For example, the following webhook action creates a Pagerduty trigger event.

"actions" : {
  "send_trigger" : {
    "throttle_period" : "5m",
    "webhook" : {
      "method" : "POST",
      "host" : "events.pagerduty.com",
      "scheme" : "https",
      "port" : 443,
      "path": ":/generic/2010-04-15/create_event.json}",
      "body" : "{
        \"service_key\": \"e93facc04764012d7bfb002500d5d1a6\",
        \"incident_key\": \"long_watches\",
        \"event_type\": \"trigger\",
        \"description\": \"{{ctx.payload.hits.total}} watches took more than 2.5 seconds to execute\",
        \"client\": \"Watcher\"
      }"
      "headers": {"Content-type": "application/json"}
    }
  }
}

« Using Transforms How Watcher Works »