--- type: api title: Create or update a watch description: **All methods and paths for this operation:** url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-watcher-put-watch resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-watcher-put-watch products: - Elasticsearch --- # Create or update a watch Availability: ## Paths - `POST` (also `PUT`) `/_watcher/watch/{id}` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#basicauth) - [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#bearerauth) #### Path Parameters - `id` (string Id) The identifier for the watch. ## Description When a watch is registered, a new document that represents the watch is added to the `.watches` index and its trigger is immediately registered with the relevant trigger engine. Typically for the `schedule` trigger, the scheduler is the trigger engine. IMPORTANT: You must use Kibana or this API to create a watch. Do not add a watch directly to the `.watches` index by using the Elasticsearch index API. If Elasticsearch security features are enabled, do not give users write privileges on the `.watches` index. When you add a watch you can also define its initial active state by setting the *active* parameter. When Elasticsearch security features are enabled, your watch can index or search only on indices for which the user that stored the watch has privileges. If the user is able to read index `a`, but not index `b`, the same will apply when the watch runs. ## Required authorization * Cluster privileges: `manage_watcher` ## Query String Parameters - `active` (boolean · default: true) The initial state of the watch. The default value is `true`, which means the watch is active by default. - `if_primary_term` (number) Only update the watch if the last operation that has changed the watch has the specified primary term - `if_seq_no` (number SequenceNumber) Only update the watch if the last operation that has changed the watch has the specified sequence number - `version` (number VersionNumber) Explicit version number for concurrency control ## Request Body `application/json` - `actions` (map string to Action) — optional The list of actions that will be run if the condition matches. Map values ({} Action) - `action_type` (enum ActionType) — optional Values: `email`, `webhook`, `index`, `logging`, `slack`, `pagerduty` - `condition` ({} ConditionContainer) — optional - `always` (AlwaysCondition) — optional - `array_compare` (map string to ArrayCompareCondition) — optional Map values ({} ArrayCompareCondition) - `path` (string) — required - `compare` (map string to string to FieldValue) — optional - `never` (NeverCondition) — optional - `script` ({} ScriptCondition) — optional - `lang` (ScriptLanguage · default: painless) — optional Supported values include: - `painless`: Painless scripting language, purpose-built for Elasticsearch. - `expression`: Lucene’s expressions language, compiles a JavaScript expression to bytecode. - `mustache`: Mustache templated, used for templates. - `java`: Expert Java API Values: `painless`, `expression`, `mustache`, `java` - `params` (map string to object) — optional - `source` (ScriptSource) — optional - `id` (string) — optional - `foreach` (string) — optional - `max_iterations` (number) — optional - `name` (string Name) — optional - `throttle_period` (string Duration) — optional - `throttle_period_in_millis` (DurationValueUnitMillis) — optional - `transform` ({} TransformContainer) — optional - `chain` ([] TransformContainer) — optional — recursive Same fields as `transform` in `actions` - `script` ({} ScriptTransform) — optional - `lang` (string · default: painless) — optional - `params` (map string to object) — optional - `source` (ScriptSource) — optional - `id` (string) — optional - `search` ({} SearchTransform) — optional - `request` ({} SearchInputRequestDefinition) — required - `body` ({} SearchRequestBody) — optional - `aggregations` (map string to {} AggregationContainer) — optional Defines the aggregations that are run as part of the search request. See [AggregationContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-aggregations-aggregationcontainer) - `collapse` ({} FieldCollapse) — optional Collapses search results the values of the specified field. - `field` (string Field) — required The field to collapse the result set on - `inner_hits` (union oneOf) — optional The number of inner hits and their sort order `InnerHits` or `InnerHits[]` - `name` (string Name) — optional The name for the particular inner hit definition in the response. Useful when a search request contains multiple inner hits. - `size` (number · default: 3) — optional The maximum number of hits to return per `inner_hits`. - `from` (number · default: 0) — optional Inner hit starting document offset. - `collapse` ({} FieldCollapse) — optional — recursive Same fields as `collapse` in `body` - `docvalue_fields` ([] FieldAndFormat) — optional - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `explain` (boolean) — optional - `highlight` ({} Highlight) — optional - `type` (HighlighterType) — optional Supported values include: - `plain`: The `plain` highlighter uses the standard Lucene highlighter - `fvh`: The fvh highlighter uses the Lucene Fast Vector highlighter. - `unified`: The unified highlighter uses the Lucene Unified Highlighter. Values: `plain`, `fvh`, `unified` - `boundary_chars` (string · default: .,!? \t\n) — optional A string that contains each boundary character. - `boundary_max_scan` (number · default: 20) — optional How far to scan for boundary characters. - `boundary_scanner` (enum BoundaryScanner) — optional Specifies how to break the highlighted fragments: chars, sentence, or word. Only valid for the unified and fvh highlighters. Defaults to `sentence` for the `unified` highlighter. Defaults to `chars` for the `fvh` highlighter. Supported values include: - `chars`: Use the characters specified by `boundary_chars` as highlighting boundaries. The `boundary_max_scan` setting controls how far to scan for boundary characters. Only valid for the `fvh` highlighter. - `sentence`: Break highlighted fragments at the next sentence boundary, as determined by Java’s `BreakIterator`. You can specify the locale to use with `boundary_scanner_locale`. When used with the `unified` highlighter, the `sentence` scanner splits sentences bigger than `fragment_size` at the first word boundary next to fragment_size. You can set `fragment_size` to `0` to never split any sentence. - `word`: Break highlighted fragments at the next word boundary, as determined by Java’s `BreakIterator`. You can specify the locale to use with `boundary_scanner_locale`. Values: `chars`, `sentence`, `word` - `boundary_scanner_locale` (string · default: Locale.ROOT) — optional Controls which locale is used to search for sentence and word boundaries. This parameter takes a form of a language tag, for example: `"en-US"`, `"fr-FR"`, `"ja-JP"`. - `force_source` (boolean) — optional — deprecated - `fragmenter` (enum HighlighterFragmenter · default: span) — optional Specifies how text should be broken up in highlight snippets: `simple` or `span`. Only valid for the `plain` highlighter. Values: `simple`, `span` - `fragment_size` (number · default: 100) — optional The size of the highlighted fragment in characters. - `highlight_filter` (boolean) — optional - `highlight_query` ({} QueryContainer) — optional Highlight matches for a query other than the search query. This is especially useful if you use a rescore query because those are not taken into account by highlighting by default. See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `max_fragment_length` (number) — optional - `max_analyzed_offset` (number) — optional If set to a non-negative value, highlighting stops at this defined maximum limit. The rest of the text is not processed, thus not highlighted and no error is returned The `max_analyzed_offset` query setting does not override the `index.highlight.max_analyzed_offset` setting, which prevails when it’s set to lower value than the query setting. - `no_match_size` (number · default: 0) — optional The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight. - `number_of_fragments` (number · default: 5) — optional The maximum number of fragments to return. If the number of fragments is set to `0`, no fragments are returned. Instead, the entire field contents are highlighted and returned. This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required. If `number_of_fragments` is `0`, `fragment_size` is ignored. - `options` (map string to object) — optional - `order` (enum HighlighterOrder · default: none) — optional Sorts highlighted fragments by score when set to `score`. By default, fragments will be output in the order they appear in the field (order: `none`). Setting this option to `score` will output the most relevant fragments first. Each highlighter applies its own logic to compute relevancy scores. Values: `score` - `phrase_limit` (number · default: 256) — optional Controls the number of matching phrases in a document that are considered. Prevents the `fvh` highlighter from analyzing too many phrases and consuming too much memory. When using `matched_fields`, `phrase_limit` phrases per matched field are considered. Raising the limit increases query time and consumes more memory. Only supported by the `fvh` highlighter. - `post_tags` ([] string) — optional Use in conjunction with `pre_tags` to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in `` and `` tags. - `pre_tags` ([] string) — optional Use in conjunction with `post_tags` to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in `` and `` tags. - `require_field_match` (boolean · default: true) — optional By default, only fields that contains a query match are highlighted. Set to `false` to highlight all fields. - `tags_schema` (enum HighlighterTagsSchema) — optional Set to `styled` to use the built-in tag schema. Values: `styled` - `encoder` (enum HighlighterEncoder) — optional Values: `default`, `html` - `fields` (union oneOf) — required `map string to HighlightField` or `[] map string to HighlightField` - `ignore_unmapped` (boolean) — optional - `script_fields` (map string to ScriptField) — optional Map values ({} ScriptField) - `script` (string Script) — required - `ignore_failure` (boolean) — optional - `seq_no_primary_term` (boolean) — optional - `field` ([] string Field) — optional - `fields` ([] FieldAndFormat) — optional - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `sort` (Sort) — optional How the inner hits should be sorted per `inner_hits`. By default, inner hits are sorted by score. - `_source` (SourceConfig) — optional - `stored_fields` (string Fields) — optional - `track_scores` (boolean · default: false) — optional - `version` (boolean) — optional - `max_concurrent_group_searches` (number) — optional The number of concurrent requests allowed to retrieve the inner_hits per group - `collapse` ({} FieldCollapse) — optional — recursive Same fields as `collapse` in `body` - `explain` (boolean · default: false) — optional If `true`, the request returns detailed information about score computation as part of a hit. - `ext` (map string to object) — optional Configuration of search extensions defined by Elasticsearch plugins. - `from` (number · default: 0) — optional The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter. - `highlight` ({} Highlight) — optional Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results. Same fields as `highlight` in `inner_hits` - `track_total_hits` (boolean | number · default: 10000) — optional Number of hits matching the query to count accurately. If `true`, the exact number of hits is returned at the cost of some performance. If `false`, the response does not include the total number of hits matching the query. - `indices_boost` ([] string to number) — optional Boost the `_score` of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than `1.0` increases the score. A boost value between `0` and `1.0` decreases the score. - `docvalue_fields` ([] FieldAndFormat) — optional An array of wildcard (`*`) field patterns. The request returns doc values for field names matching these patterns in the `hits.fields` property of the response. - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `knn` (union oneOf) — optional The approximate kNN search to run. `KnnSearch` or `KnnSearch[]` - `field` (string Field) — required The name of the vector field to search against - `query_vector` (QueryVector) — optional The query vector - `query_vector_builder` ({} QueryVectorBuilder) — optional The query vector builder. You must provide a query_vector_builder or query_vector, but not both. - `embedding` ({} Embedding) — optional - `inference_id` (string) — optional - `input` (KnnEmbeddingInput) — required - `timeout` (string Duration) — optional - `text_embedding` ({} TextEmbedding) — optional - `model_id` (string) — optional Model ID is required for all dense_vector fields but may be inferred for semantic_text fields - `model_text` (string) — required The text to be converted into a vector by the specified model - `lookup` ({} LookupQueryVectorBuilder) — optional Lookup a vector from an existing document. Must reference a dense_vector field and a single value. - `id` (string) — required The ID of the document to fetch the vector from - `index` (string) — required The name of the index to fetch the document from - `path` (string) — required The name of the field containing the vector - `routing` (string) — optional The routing value to use when fetching the document - `k` (number) — optional The final number of nearest neighbors to return as top hits - `num_candidates` (number) — optional The number of nearest neighbor candidates to consider per shard - `visit_percentage` (number) — optional The percentage of vectors to explore per shard while doing knn search with bbq_disk - `boost` (number) — optional Boost value to apply to kNN scores - `filter` (union oneOf) — optional Filters for the kNN search query One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `similarity` (number) — optional The minimum similarity for a vector to be considered a match - `inner_hits` ({} InnerHits) — optional If defined, each search hit will contain inner hits. - `name` (string Name) — optional The name for the particular inner hit definition in the response. Useful when a search request contains multiple inner hits. - `size` (number · default: 3) — optional The maximum number of hits to return per `inner_hits`. - `from` (number · default: 0) — optional Inner hit starting document offset. - `collapse` ({} FieldCollapse) — optional - `field` (string Field) — required The field to collapse the result set on - `inner_hits` (union oneOf) — optional — recursive The number of inner hits and their sort order `InnerHits` or `InnerHits[]` - `max_concurrent_group_searches` (number) — optional The number of concurrent requests allowed to retrieve the inner_hits per group - `collapse` ({} FieldCollapse) — optional — recursive Same fields as `collapse` in `inner_hits` - `docvalue_fields` ([] FieldAndFormat) — optional - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `explain` (boolean) — optional - `highlight` ({} Highlight) — optional Same fields as `highlight` in `inner_hits` - `ignore_unmapped` (boolean) — optional - `script_fields` (map string to ScriptField) — optional Map values ({} ScriptField) - `script` (string Script) — required - `ignore_failure` (boolean) — optional - `seq_no_primary_term` (boolean) — optional - `field` ([] string Field) — optional - `fields` ([] FieldAndFormat) — optional - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `sort` (Sort) — optional How the inner hits should be sorted per `inner_hits`. By default, inner hits are sorted by score. - `_source` (SourceConfig) — optional - `stored_fields` (string Fields) — optional - `track_scores` (boolean · default: false) — optional - `version` (boolean) — optional - `rescore_vector` ({} RescoreVector) — optional Apply oversampling and rescoring to quantized vectors - `oversample` (number) — required Applies the specified oversample factor to k on the approximate kNN search - `_name` (string) — optional - `rank` ({} RankContainer) — optional The Reciprocal Rank Fusion (RRF) to use. - `rrf` ({} RrfRank) — optional The reciprocal rank fusion parameters - `rank_constant` (number) — optional How much influence documents in individual result sets per query have over the final ranked result set - `rank_window_size` (number) — optional Size of the individual result sets per query - `min_score` (number) — optional The minimum `_score` for matching documents. Documents with a lower `_score` are not included in search results or results collected by aggregations. - `post_filter` ({} QueryContainer) — optional Use the `post_filter` parameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results. See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `profile` (boolean · default: false) — optional Set to `true` to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution. - `query` ({} QueryContainer) — optional The search definition using the Query DSL. See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `rescore` (union oneOf) — optional Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the `query` and `post_filter` phases. `Rescore` or `Rescore[]` - `window_size` (number) — optional - `query` ({} RescoreQuery) — optional - `rescore_query` ({} QueryContainer) — required The query to use for rescoring. This query is only run on the Top-K results returned by the `query` and `post_filter` phases. See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `query_weight` (number · default: 1) — optional Relative importance of the original query versus the rescore query. - `rescore_query_weight` (number · default: 1) — optional Relative importance of the rescore query versus the original query. - `score_mode` (enum ScoreMode · default: total) — optional Determines how scores are combined. Supported values include: - `avg`: Average the original score and the rescore query score. - `max`: Take the max of original score and the rescore query score. - `min`: Take the min of the original score and the rescore query score. - `multiply`: Multiply the original score by the rescore query score. Useful for `function` query rescores. - `total`: Add the original score and the rescore query score. Values: `avg`, `max`, `min`, `multiply`, `total` - `learning_to_rank` ({} LearningToRank) — optional - `model_id` (string) — required The unique identifier of the trained model uploaded to Elasticsearch - `params` (map string to object) — optional Named parameters to be passed to the query templates used for feature - `script` ({} ScriptRescore) — optional - `script` (string Script) — required - `retriever` ({} RetrieverContainer) — optional A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as `query` and `knn`. - `standard` ({} StandardRetriever) — optional A retriever that replaces the functionality of a traditional query. - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `query` ({} QueryContainer) — optional Defines a query to retrieve a set of top documents. See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `search_after` (SortResults) — optional Defines a search after object parameter used for pagination. - `terminate_after` (number) — optional Maximum number of documents to collect for each shard. - `sort` (Sort) — optional A sort object that that specifies the order of matching documents. - `collapse` ({} FieldCollapse) — optional Collapses the top documents by a specified key into a single top document per key. Same fields as `collapse` in `body` - `knn` ({} KnnRetriever) — optional A retriever that replaces the functionality of a knn search. - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `field` (string) — required The name of the vector field to search against. - `query_vector` (QueryVector) — optional Query vector. Must have the same number of dimensions as the vector field you are searching against. You must provide a query_vector_builder or query_vector, but not both. - `query_vector_builder` ({} QueryVectorBuilder) — optional Defines a model to build a query vector. Same fields as `query_vector_builder` in `knn` - `k` (number) — required Number of nearest neighbors to return as top hits. - `num_candidates` (number) — optional Number of nearest neighbor candidates to consider per shard. - `visit_percentage` (number) — optional The percentage of vectors to explore per shard while doing knn search with bbq_disk - `similarity` (number) — optional The minimum similarity required for a document to be considered a match. - `rescore_vector` ({} RescoreVector) — optional Apply oversampling and rescoring to quantized vectors - `oversample` (number) — required Applies the specified oversample factor to k on the approximate kNN search - `rrf` ({} RRFRetriever) — optional A retriever that produces top documents from reciprocal rank fusion (RRF). - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `retrievers` ([] union RRFRetrieverEntry) — required — recursive A list of child retrievers to specify which sets of returned top documents will have the RRF formula applied to them. Each retriever can optionally include a weight parameter. - `rank_constant` (number) — optional This value determines how much influence documents in individual result sets per query have over the final ranked result set. - `rank_window_size` (number) — optional This value determines the size of the individual result sets per query. - `query` (string) — optional - `fields` ([] string) — optional - `text_similarity_reranker` ({} TextSimilarityReranker) — optional A retriever that reranks the top documents based on a reranking model using the InferenceAPI - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `retriever` ({} RetrieverContainer) — required — recursive The nested retriever which will produce the first-level results, that will later be used for reranking. Same fields as `retriever` in `body` - `rank_window_size` (number) — optional This value determines how many documents we will consider from the nested retriever. - `inference_id` (string) — optional Unique identifier of the inference endpoint created using the inference API. - `inference_text` (string) — required The text snippet used as the basis for similarity comparison. - `field` (string) — required The document field to be used for text similarity comparisons. This field should contain the text that will be evaluated against the inference_text. - `chunk_rescorer` ({} ChunkRescorer) — optional Whether to rescore on only the best matching chunks. - `size` (number) — optional The number of chunks per document to evaluate for reranking. - `chunking_settings` ({} ChunkRescorerChunkingSettings) — optional Chunking settings to apply - `max_chunk_size` (number · default: 250) — required The maximum size of a chunk in words. This value cannot be lower than `20` (for `sentence` strategy) or `10` (for `word` strategy). This value should not exceed the window size for the associated model. - `overlap` (number · default: 100) — optional The number of overlapping words for chunks. It is applicable only to a `word` chunking strategy. This value cannot be higher than half the `max_chunk_size` value. - `sentence_overlap` (number · default: 1) — optional The number of overlapping sentences for chunks. It is applicable only for a `sentence` chunking strategy. It can be either `1` or `0`. - `separator_group` (string) — optional Only applicable to the `recursive` strategy and required when using it. Sets a predefined list of separators in the saved chunking settings based on the selected text type. Values can be `markdown` or `plaintext`. Using this parameter is an alternative to manually specifying a custom `separators` list. - `separators` ([] string) — optional Only applicable to the `recursive` strategy and required when using it. A list of strings used as possible split points when chunking text. Each string can be a plain string or a regular expression (regex) pattern. The system tries each separator in order to split the text, starting from the first item in the list. After splitting, it attempts to recombine smaller pieces into larger chunks that stay within the `max_chunk_size` limit, to reduce the total number of chunks generated. - `strategy` (string · default: sentence) — optional The chunking strategy: `sentence`, `word`, `none` or `recursive`. * If `strategy` is set to `recursive`, you must also specify: - `max_chunk_size` - either `separators` or`separator_group` Learn more about different chunking strategies in the linked documentation. - `rule` ({} RuleRetriever) — optional A retriever that replaces the functionality of a rule query. - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `ruleset_ids` (union Id | [] Id) — required The ruleset IDs containing the rules this retriever is evaluating against. - `match_criteria` (object) — required The match criteria that will determine if a rule in the provided rulesets should be applied. - `retriever` ({} RetrieverContainer) — required — recursive The retriever whose results rules should be applied to. Same fields as `retriever` in `body` - `rank_window_size` (number) — optional This value determines the size of the individual result set. - `rescorer` ({} RescorerRetriever) — optional A retriever that re-scores only the results produced by its child retriever. - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `retriever` ({} RetrieverContainer) — required — recursive Inner retriever. Same fields as `retriever` in `body` - `rescore` (union oneOf) — required Same options as `rescore` in `body` `Rescore` or `Rescore[]` - `linear` ({} LinearRetriever) — optional A retriever that supports the combination of different retrievers through a weighted linear combination. - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `retrievers` ([] InnerRetriever) — optional Inner retrievers. - `retriever` ({} RetrieverContainer) — required — recursive The nested retriever configuration. Same fields as `retriever` in `body` - `weight` (number · default: 1) — optional Weight multiplier for this retriever's contribution to the linear combination. Must be non-negative. - `normalizer` (enum ScoreNormalizer · default: none) — optional Score normalizer to apply to this retriever's results before weighting. Falls back to the top-level `normalizer` on the linear retriever if unset, then to `none` (identity) if neither is set. Values: `none`, `minmax`, `l2_norm` - `rank_window_size` (number) — optional - `query` (string) — optional - `fields` ([] string) — optional - `normalizer` (enum ScoreNormalizer) — optional Values: `none`, `minmax`, `l2_norm` - `pinned` ({} PinnedRetriever) — optional A pinned retriever applies pinned documents to the underlying retriever. This retriever will rewrite to a PinnedQueryBuilder. - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `retriever` ({} RetrieverContainer) — required — recursive Inner retriever. Same fields as `retriever` in `body` - `ids` ([] string) — optional - `docs` ([] SpecifiedDocument) — optional - `index` (string IndexName) — optional - `id` (string Id) — required - `rank_window_size` (number) — optional - `diversify` ({} DiversifyRetriever) — optional A retriever that diversifies the results from its child retriever. - `filter` (union oneOf) — optional Query to filter the documents that can match. One of: [`QueryContainer[]`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`QueryContainer`](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `min_score` (number) — optional Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. - `_name` (string) — optional Retriever name. - `type` (enum DiversifyRetrieverTypes) — required The diversification strategy to apply. Values: `mmr` - `field` (string) — required The document field on which to diversify results on. - `retriever` ({} RetrieverContainer) — required — recursive The nested retriever whose results will be diversified. Same fields as `retriever` in `body` - `size` (number) — optional The number of top documents to return after diversification. - `rank_window_size` (number) — optional The number of top documents from the nested retriever to consider for diversification. - `query_vector` (QueryVector) — optional The query vector used for diversification. - `query_vector_builder` ({} QueryVectorBuilder) — optional a dense vector query vector builder to use instead of a static query_vector Same fields as `query_vector_builder` in `knn` - `lambda` (number) — optional Controls the trade-off between relevance and diversity for MMR. A value of 0.0 focuses solely on diversity, while a value of 1.0 focuses solely on relevance. Required for MMR - `script_fields` (map string to ScriptField) — optional Retrieve a script evaluation (based on different fields) for each hit. Map values ({} ScriptField) - `script` (string Script) — required - `ignore_failure` (boolean) — optional - `search_after` (SortResults) — optional Used to retrieve the next page of hits using a set of sort values from the previous page. - `size` (number · default: 10) — optional The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` property. - `slice` ({} SlicedScroll) — optional Split a scrolled search into multiple slices that can be consumed independently. - `field` (string Field) — optional - `id` (string Id) — required - `max` (number) — required - `sort` (Sort) — optional A comma-separated list of : pairs. - `_source` (SourceConfig) — optional The source fields that are returned for matching documents. These fields are returned in the `hits._source` property of the search response. If the `stored_fields` property is specified, the `_source` property defaults to `false`. Otherwise, it defaults to `true`. - `fields` ([] FieldAndFormat) — optional An array of wildcard (`*`) field patterns. The request returns values for field names matching these patterns in the `hits.fields` property of the response. - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `suggest` ({} Suggester) — optional Defines a suggester that provides similar looking terms based on a provided text. - `text` (string) — optional Global suggest text, to avoid repetition when the same text is used in several suggesters - `terminate_after` (number · default: 0) — optional The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers. If set to `0` (default), the query does not terminate early. - `timeout` (string) — optional The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout. - `track_scores` (boolean · default: false) — optional If `true`, calculate and return document scores, even if the scores are not used for sorting. - `version` (boolean · default: false) — optional If `true`, the request returns the document version as part of a hit. - `seq_no_primary_term` (boolean) — optional If `true`, the request returns sequence number and primary term of the last modification of each hit. - `stored_fields` (string Fields) — optional A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the `_source` property defaults to `false`. You can pass `_source: true` to return both source fields and stored fields in the search response. - `pit` ({} PointInTimeReference) — optional Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an `` in the request path. - `id` (string Id) — required - `keep_alive` (string Duration) — optional - `runtime_mappings` (RuntimeFields) — optional One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name. - `stats` ([] string) — optional The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API. - `indices` (string Indices) — optional - `indices_options` ({} IndicesOptions) — optional - `allow_no_indices` (boolean) — optional A setting that does two separate checks on the index expression. If `false`, the request returns an error (1) if any wildcard expression (including `_all` and `*`) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If `true`, index expressions that resolve to no indices are allowed and the request returns an empty result. - `expand_wildcards` (string ExpandWildcards) — optional Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as `open,hidden`. Supported values include: - `all`: Match any data stream or index, including hidden ones. - `open`: Match open, non-hidden indices. Also matches any non-hidden data stream. - `closed`: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - `hidden`: Match hidden data streams and hidden indices. Must be combined with `open`, `closed`, or `both`. - `none`: Wildcard expressions are not accepted. Values: `all`, `open`, `closed`, `hidden`, `none` - `ignore_unavailable` (boolean · default: false) — optional If `false`, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If `true`, unavailable concrete targets are silently ignored. - `ignore_throttled` (boolean · default: true) — optional If true, concrete, expanded or aliased indices are ignored when frozen. - `search_type` (enum SearchType) — optional Supported values include: - `query_then_fetch`: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - `dfs_query_then_fetch`: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate. Values: `query_then_fetch`, `dfs_query_then_fetch` - `template` ({} SearchTemplateRequestBody) — optional - `explain` (boolean · default: false) — optional - `id` (string Id) — optional ID of the search template to use. If no source is specified, this parameter is required. - `lang` (ScriptLanguage · default: mustache) — optional The language the template is written in. It is reported in the resolved search input of a watch record. Supported values include: - `painless`: Painless scripting language, purpose-built for Elasticsearch. - `expression`: Lucene’s expressions language, compiles a JavaScript expression to bytecode. - `mustache`: Mustache templated, used for templates. - `java`: Expert Java API Values: `painless`, `expression`, `mustache`, `java` - `params` (map string to object) — optional - `profile` (boolean · default: false) — optional - `source` (string) — optional An inline search template. Supports the same parameters as the search API's request body. Also supports Mustache variables. If no id is specified, this parameter is required. - `rest_total_hits_as_int` (boolean) — optional - `timeout` (string Duration) — optional - `index` ({} IndexAction) — optional - `index` (string IndexName) — optional - `doc_id` (string Id) — optional - `refresh` (enum Refresh) — optional Values: `true`, `false`, `wait_for` - `op_type` (enum OpType · default: index) — optional Supported values include: - `index`: Overwrite any documents that already exist. - `create`: Only index documents that do not already exist. Values: `index`, `create` - `timeout` (string Duration · default: 60s) — optional - `execution_time_field` (string Field) — optional - `logging` ({} LoggingAction) — optional - `level` (string) — optional - `text` (string) — required - `category` (string) — optional - `email` ({} EmailAction) — optional - `id` (string Id) — optional - `bcc` (union string | [] string) — optional - `body` ({} EmailBody) — optional - `html` (string) — optional - `text` (string) — optional - `cc` (union string | [] string) — optional - `from` (string) — optional - `priority` (enum EmailPriority) — optional Values: `lowest`, `low`, `normal`, `high`, `highest` - `reply_to` (union string | [] string) — optional - `sent_date` (DateTime) — optional - `subject` (string) — required - `to` (union string | [] string) — required - `attachments` (map string to EmailAttachmentContainer) — optional Map values ({} EmailAttachmentContainer) - `http` ({} HttpEmailAttachment) — optional - `content_type` (string) — optional - `inline` (boolean) — optional - `request` ({} HttpInputRequestDefinition) — optional - `auth` ({} HttpInputAuthentication) — optional - `basic` ({} HttpInputBasicAuthentication) — required - `password` (string) — required - `username` (string) — required - `body` (string) — optional - `connection_timeout` (string Duration) — optional - `headers` (map string to string) — optional - `host` (string) — optional - `method` (enum HttpInputMethod) — optional Values: `head`, `get`, `post`, `put`, `delete` - `params` (map string to string) — optional - `path` (string) — optional - `port` (number uint) — optional - `proxy` ({} HttpInputProxy) — optional - `host` (string) — required - `port` (number uint) — required - `read_timeout` (string Duration) — optional - `scheme` (enum ConnectionScheme) — optional Values: `http`, `https` - `url` (string) — optional - `reporting` ({} ReportingEmailAttachment) — optional - `url` (string) — required - `inline` (boolean) — optional - `retries` (number · default: 40) — optional - `interval` (string Duration · default: 15s) — optional - `request` ({} HttpInputRequestDefinition) — optional Same fields as `request` in `http` - `data` ({} DataEmailAttachment) — optional - `format` (enum DataAttachmentFormat) — optional Values: `json`, `yaml` - `pagerduty` ({} PagerDutyAction) — optional - `account` (string) — optional - `attach_payload` (boolean) — required - `client` (string) — optional - `client_url` (string) — optional - `contexts` ([] PagerDutyContext) — optional - `href` (string) — optional - `src` (string) — optional - `type` (enum PagerDutyContextType) — required Values: `link`, `image` - `description` (string) — required - `event_type` (enum PagerDutyEventType · default: trigger) — optional Values: `trigger`, `resolve`, `acknowledge` - `incident_key` (string) — required - `proxy` ({} PagerDutyEventProxy) — optional - `host` (string) — optional - `port` (number) — optional - `slack` ({} SlackAction) — optional - `account` (string) — optional - `message` ({} SlackMessage) — required - `attachments` ([] SlackAttachment) — required - `author_icon` (string) — optional - `author_link` (string) — optional - `author_name` (string) — required - `color` (string) — optional - `fallback` (string) — optional - `fields` ([] SlackAttachmentField) — optional - `short` (boolean) — required - `title` (string) — required - `value` (string) — required - `footer` (string) — optional - `footer_icon` (string) — optional - `image_url` (string) — optional - `pretext` (string) — optional - `text` (string) — optional - `thumb_url` (string) — optional - `title` (string) — required - `title_link` (string) — optional - `ts` (EpochTimeUnitSeconds) — optional - `dynamic_attachments` ({} SlackDynamicAttachment) — optional - `attachment_template` ({} SlackAttachment) — required Same fields as `attachments` in `message` - `list_path` (string) — required - `from` (string) — required - `icon` (string) — optional - `text` (string) — required - `to` ([] string) — required - `webhook` ({} WebhookAction) — optional - `auth` ({} HttpInputAuthentication) — optional - `basic` ({} HttpInputBasicAuthentication) — required - `password` (string) — required - `username` (string) — required - `body` (string) — optional - `connection_timeout` (string Duration) — optional - `headers` (map string to string) — optional - `host` (string) — optional - `method` (enum HttpInputMethod) — optional Values: `head`, `get`, `post`, `put`, `delete` - `params` (map string to string) — optional - `path` (string) — optional - `port` (number uint) — optional - `proxy` ({} HttpInputProxy) — optional - `host` (string) — required - `port` (number uint) — required - `read_timeout` (string Duration) — optional - `scheme` (enum ConnectionScheme) — optional Values: `http`, `https` - `url` (string) — optional - `condition` ({} ConditionContainer) — optional The condition that defines if the actions should be run. Same fields as `condition` in `actions` - `input` ({} InputContainer) — optional The input that defines the input that loads the data for the watch. - `chain` ({} ChainInput) — optional - `inputs` ([] string to InputContainer) — required — recursive Same fields as `input` - `http` ({} HttpInput) — optional - `extract` ([] string) — optional - `request` ({} HttpInputRequestDefinition) — optional Same fields as `request` in `http` - `response_content_type` (enum ResponseContentType) — optional Values: `json`, `yaml`, `text` - `search` ({} SearchInput) — optional - `extract` ([] string) — optional - `request` ({} SearchInputRequestDefinition) — required - `body` ({} SearchRequestBody) — optional - `aggregations` (map string to {} AggregationContainer) — optional Defines the aggregations that are run as part of the search request. See [AggregationContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-aggregations-aggregationcontainer) - `collapse` ({} FieldCollapse) — optional Collapses search results the values of the specified field. Same fields as `collapse` in `body` - `explain` (boolean · default: false) — optional If `true`, the request returns detailed information about score computation as part of a hit. - `ext` (map string to object) — optional Configuration of search extensions defined by Elasticsearch plugins. - `from` (number · default: 0) — optional The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter. - `highlight` ({} Highlight) — optional Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results. Same fields as `highlight` in `inner_hits` - `track_total_hits` (boolean | number · default: 10000) — optional Number of hits matching the query to count accurately. If `true`, the exact number of hits is returned at the cost of some performance. If `false`, the response does not include the total number of hits matching the query. - `indices_boost` ([] string to number) — optional Boost the `_score` of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than `1.0` increases the score. A boost value between `0` and `1.0` decreases the score. - `docvalue_fields` ([] FieldAndFormat) — optional An array of wildcard (`*`) field patterns. The request returns doc values for field names matching these patterns in the `hits.fields` property of the response. - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `knn` (union oneOf) — optional The approximate kNN search to run. Same options as `knn` in `body` `KnnSearch` or `KnnSearch[]` - `rank` ({} RankContainer) — optional The Reciprocal Rank Fusion (RRF) to use. - `rrf` ({} RrfRank) — optional The reciprocal rank fusion parameters - `rank_constant` (number) — optional How much influence documents in individual result sets per query have over the final ranked result set - `rank_window_size` (number) — optional Size of the individual result sets per query - `min_score` (number) — optional The minimum `_score` for matching documents. Documents with a lower `_score` are not included in search results or results collected by aggregations. - `post_filter` ({} QueryContainer) — optional Use the `post_filter` parameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results. See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `profile` (boolean · default: false) — optional Set to `true` to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution. - `query` ({} QueryContainer) — optional The search definition using the Query DSL. See [QueryContainer](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) - `rescore` (union oneOf) — optional Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the `query` and `post_filter` phases. Same options as `rescore` in `body` `Rescore` or `Rescore[]` - `retriever` ({} RetrieverContainer) — optional A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as `query` and `knn`. Same fields as `retriever` in `body` - `script_fields` (map string to ScriptField) — optional Retrieve a script evaluation (based on different fields) for each hit. Map values ({} ScriptField) - `script` (string Script) — required - `ignore_failure` (boolean) — optional - `search_after` (SortResults) — optional Used to retrieve the next page of hits using a set of sort values from the previous page. - `size` (number · default: 10) — optional The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` property. - `slice` ({} SlicedScroll) — optional Split a scrolled search into multiple slices that can be consumed independently. - `field` (string Field) — optional - `id` (string Id) — required - `max` (number) — required - `sort` (Sort) — optional A comma-separated list of : pairs. - `_source` (SourceConfig) — optional The source fields that are returned for matching documents. These fields are returned in the `hits._source` property of the search response. If the `stored_fields` property is specified, the `_source` property defaults to `false`. Otherwise, it defaults to `true`. - `fields` ([] FieldAndFormat) — optional An array of wildcard (`*`) field patterns. The request returns values for field names matching these patterns in the `hits.fields` property of the response. - `field` (string Field) — required A wildcard pattern. The request returns values for field names matching this pattern. - `format` (string) — optional The format in which the values are returned. - `include_unmapped` (boolean) — optional - `suggest` ({} Suggester) — optional Defines a suggester that provides similar looking terms based on a provided text. - `text` (string) — optional Global suggest text, to avoid repetition when the same text is used in several suggesters - `terminate_after` (number · default: 0) — optional The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers. If set to `0` (default), the query does not terminate early. - `timeout` (string) — optional The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout. - `track_scores` (boolean · default: false) — optional If `true`, calculate and return document scores, even if the scores are not used for sorting. - `version` (boolean · default: false) — optional If `true`, the request returns the document version as part of a hit. - `seq_no_primary_term` (boolean) — optional If `true`, the request returns sequence number and primary term of the last modification of each hit. - `stored_fields` (string Fields) — optional A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the `_source` property defaults to `false`. You can pass `_source: true` to return both source fields and stored fields in the search response. - `pit` ({} PointInTimeReference) — optional Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an `` in the request path. - `id` (string Id) — required - `keep_alive` (string Duration) — optional - `runtime_mappings` (RuntimeFields) — optional One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name. - `stats` ([] string) — optional The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API. - `indices` (string Indices) — optional - `indices_options` ({} IndicesOptions) — optional - `allow_no_indices` (boolean) — optional A setting that does two separate checks on the index expression. If `false`, the request returns an error (1) if any wildcard expression (including `_all` and `*`) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If `true`, index expressions that resolve to no indices are allowed and the request returns an empty result. - `expand_wildcards` (string ExpandWildcards) — optional Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as `open,hidden`. Supported values include: - `all`: Match any data stream or index, including hidden ones. - `open`: Match open, non-hidden indices. Also matches any non-hidden data stream. - `closed`: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - `hidden`: Match hidden data streams and hidden indices. Must be combined with `open`, `closed`, or `both`. - `none`: Wildcard expressions are not accepted. Values: `all`, `open`, `closed`, `hidden`, `none` - `ignore_unavailable` (boolean · default: false) — optional If `false`, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If `true`, unavailable concrete targets are silently ignored. - `ignore_throttled` (boolean · default: true) — optional If true, concrete, expanded or aliased indices are ignored when frozen. - `search_type` (enum SearchType) — optional Supported values include: - `query_then_fetch`: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - `dfs_query_then_fetch`: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate. Values: `query_then_fetch`, `dfs_query_then_fetch` - `template` ({} SearchTemplateRequestBody) — optional - `explain` (boolean · default: false) — optional - `id` (string Id) — optional ID of the search template to use. If no source is specified, this parameter is required. - `lang` (ScriptLanguage · default: mustache) — optional The language the template is written in. It is reported in the resolved search input of a watch record. Supported values include: - `painless`: Painless scripting language, purpose-built for Elasticsearch. - `expression`: Lucene’s expressions language, compiles a JavaScript expression to bytecode. - `mustache`: Mustache templated, used for templates. - `java`: Expert Java API Values: `painless`, `expression`, `mustache`, `java` - `params` (map string to object) — optional - `profile` (boolean · default: false) — optional - `source` (string) — optional An inline search template. Supports the same parameters as the search API's request body. Also supports Mustache variables. If no id is specified, this parameter is required. - `rest_total_hits_as_int` (boolean) — optional - `timeout` (string Duration) — optional - `simple` (map string to object) — optional - `transform` ({} TransformContainer) — optional - `chain` ([] TransformContainer) — optional — recursive Same fields as `transform` in `input` - `script` ({} ScriptTransform) — optional - `lang` (string · default: painless) — optional - `params` (map string to object) — optional - `source` (ScriptSource) — optional - `id` (string) — optional - `search` ({} SearchTransform) — optional - `request` ({} SearchInputRequestDefinition) — required Same fields as `request` in `search` - `timeout` (string Duration) — optional - `metadata` (Metadata) — optional Metadata JSON that will be copied into the history entries. - `throttle_period` (string Duration) — optional The minimum time between actions being run. The default is 5 seconds. This default can be changed in the config file with the setting `xpack.watcher.throttle.period.default_period`. If both this value and the `throttle_period_in_millis` parameter are specified, Watcher uses the last parameter included in the request. - `throttle_period_in_millis` (DurationValueUnitMillis) — optional Minimum time in milliseconds between actions being run. Defaults to 5000. If both this value and the throttle_period parameter are specified, Watcher uses the last parameter included in the request. - `transform` ({} TransformContainer) — optional The transform that processes the watch payload to prepare it for the watch actions. - `chain` ([] TransformContainer) — optional — recursive Same fields as `transform` - `script` ({} ScriptTransform) — optional - `lang` (string · default: painless) — optional - `params` (map string to object) — optional - `source` (ScriptSource) — optional - `id` (string) — optional - `search` ({} SearchTransform) — optional - `request` ({} SearchInputRequestDefinition) — required Same fields as `request` in `search` - `timeout` (string Duration) — optional - `trigger` ({} TriggerContainer) — optional The trigger that defines when the watch should run. - `schedule` ({} ScheduleContainer) — optional - `timezone` (string) — optional - `cron` (string) — optional - `daily` ({} DailySchedule) — optional - `at` ([] union ScheduleTimeOfDay) — required - **string** - **HourAndMinute** - `hour` ([] number) — required - `minute` ([] number) — required - `hourly` ({} HourlySchedule) — optional - `minute` ([] number) — required - `interval` (string Duration) — optional - `monthly` (union oneOf) — optional `TimeOfMonth` or `TimeOfMonth[]` - `at` ([] string) — required - `on` ([] number) — required - `weekly` (union oneOf) — optional `TimeOfWeek` or `TimeOfWeek[]` - `at` ([] string) — required - `on` ([] enum Day) — required Values: `sunday`, `monday`, `tuesday`, `wednesday`, `thursday`, `friday`, `saturday` - `yearly` (union oneOf) — optional `TimeOfYear` or `TimeOfYear[]` - `at` ([] string) — required - `int` ([] enum Month) — required Values: `january`, `february`, `march`, `april`, `may`, `june`, `july`, `august`, `september`, `october`, `november`, `december` - `on` ([] number) — required ## Response `application/json` - `created` (boolean) - `_id` (string Id) - `_primary_term` (number) - `_seq_no` (number SequenceNumber) - `_version` (number VersionNumber) ## Code Examples #### Console ```console POST _watcher/watch/my-watch { "trigger" : { "schedule" : { "cron" : "0 0/1 * * * ?" } }, "input" : { "search" : { "request" : { "indices" : [ "logstash*" ], "body" : { "query" : { "bool" : { "must" : { "match": { "response": 404 } }, "filter" : { "range": { "@timestamp": { "from": "{{ctx.trigger.scheduled_time}}||-5m", "to": "{{ctx.trigger.triggered_time}}" } } } } } } } } }, "condition" : { "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }} }, "actions" : { "email_admin" : { "email" : { "to" : "admin@domain.host.com", "subject" : "404 recently encountered" } } } } ``` #### JavaScript ```javascript const response = await client.watcher.putWatch({ id: "my-watch", trigger: { schedule: { cron: "0 0/1 * * * ?", }, }, input: { search: { request: { indices: ["logstash*"], body: { query: { bool: { must: { match: { response: 404, }, }, filter: { range: { "@timestamp": { from: "{{ctx.trigger.scheduled_time}}||-5m", to: "{{ctx.trigger.triggered_time}}", }, }, }, }, }, }, }, }, }, condition: { compare: { "ctx.payload.hits.total": { gt: 0, }, }, }, actions: { email_admin: { email: { to: "admin@domain.host.com", subject: "404 recently encountered", }, }, }, }); ``` #### Python ```python resp = client.watcher.put_watch( id="my-watch", trigger={ "schedule": { "cron": "0 0/1 * * * ?" } }, input={ "search": { "request": { "indices": [ "logstash*" ], "body": { "query": { "bool": { "must": { "match": { "response": 404 } }, "filter": { "range": { "@timestamp": { "from": "{{ctx.trigger.scheduled_time}}||-5m", "to": "{{ctx.trigger.triggered_time}}" } } } } } } } } }, condition={ "compare": { "ctx.payload.hits.total": { "gt": 0 } } }, actions={ "email_admin": { "email": { "to": "admin@domain.host.com", "subject": "404 recently encountered" } } }, ) ``` #### curl ```curl curl -X POST "$ELASTICSEARCH_URL/_watcher/watch/my-watch" \ -H "Authorization: ApiKey $ELASTIC_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "trigger": { "schedule": { "cron": "0 0/1 * * * ?" } }, "input": { "search": { "request": { "indices": [ "logstash*" ], "body": { "query": { "bool": { "must": { "match": { "response": 404 } }, "filter": { "range": { "@timestamp": { "from": "{{ctx.trigger.scheduled_time}}||-5m", "to": "{{ctx.trigger.triggered_time}}" } } } } } } } } }, "condition": { "compare": { "ctx.payload.hits.total": { "gt": 0 } } }, "actions": { "email_admin": { "email": { "to": "admin@domain.host.com", "subject": "404 recently encountered" } } } }' ``` #### Java ```java client.watcher().putWatch(p -> p .actions("email_admin", a -> a .email(e -> e .subject("404 recently encountered") .to("admin@domain.host.com") ) ) .condition(c -> c .compare(NamedValue.of("ctx.payload.hits.total",Pair.of(ConditionOp.Gt,FieldValue.of(0)))) ) .id("my-watch") .input(i -> i .search(s -> s .request(r -> r .body(b -> b .query(q -> q .bool(bo -> bo .filter(f -> f .range(ra -> ra .untyped(u -> u .field("@timestamp") ) ) ) .must(m -> m .match(ma -> ma .field("response") .query(FieldValue.of(404)) ) ) ) ) ) .indices("logstash*") ) ) ) .trigger(t -> t .schedule(sc -> sc .cron("0 0/1 * * * ?") ) ) ); ``` #### PHP ```php $resp = $client->watcher()->putWatch([ "id" => "my-watch", "body" => [ "trigger" => [ "schedule" => [ "cron" => "0 0/1 * * * ?", ], ], "input" => [ "search" => [ "request" => [ "indices" => array( "logstash*", ), "body" => [ "query" => [ "bool" => [ "must" => [ "match" => [ "response" => 404, ], ], "filter" => [ "range" => [ "@timestamp" => [ "from" => "{{ctx.trigger.scheduled_time}}||-5m", "to" => "{{ctx.trigger.triggered_time}}", ], ], ], ], ], ], ], ], ], "condition" => [ "compare" => [ "ctx.payload.hits.total" => [ "gt" => 0, ], ], ], "actions" => [ "email_admin" => [ "email" => [ "to" => "admin@domain.host.com", "subject" => "404 recently encountered", ], ], ], ], ]); ``` #### Ruby ```ruby response = client.watcher.put_watch( id: "my-watch", body: { "trigger": { "schedule": { "cron": "0 0/1 * * * ?" } }, "input": { "search": { "request": { "indices": [ "logstash*" ], "body": { "query": { "bool": { "must": { "match": { "response": 404 } }, "filter": { "range": { "@timestamp": { "from": "{{ctx.trigger.scheduled_time}}||-5m", "to": "{{ctx.trigger.triggered_time}}" } } } } } } } } }, "condition": { "compare": { "ctx.payload.hits.total": { "gt": 0 } } }, "actions": { "email_admin": { "email": { "to": "admin@domain.host.com", "subject": "404 recently encountered" } } } } ) ```