Run a watch

  • POST also PUT /_watcher/watch/{id}/_execute
  • POST also PUT /_watcher/watch/_execute
Auth

This API can be used to force execution of the watch outside of its triggering logic or to simulate the watch execution for debugging purposes.

For testing and debugging purposes, you also have fine-grained control on how the watch runs. You can run the watch without running all of its actions or alternatively by simulating them. You can also force execution by ignoring the watch condition and control whether a watch record would be written to the watch history after it runs.

You can use the run watch API to run watches that are not yet registered by specifying the watch definition inline. This serves as great tool for testing and debugging your watches prior to adding them to Watcher.

When Elasticsearch security features are enabled on your cluster, watches are run with the privileges of the user that stored the watches. If your user is allowed to read index a, but not index b, then the exact same set of rules will apply during execution of a watch.

When using the run watch API, the authorization data of the user that called the API will be used as a base, instead of the information who stored the watch. Refer to the external documentation for examples of watch execution requests, including existing, customized, and inline watches.

More about executing a watch

Required authorization

Cluster privileges manage_watcher

Path parameters

id string optional

The watch identifier.

Leave it out to use /_watcher/watch/_execute.

Query parameters

debug boolean · default: false

Defines whether the watch runs in debug mode.

Request body

action_modes map string to enum

Determines how to handle the watch actions as part of the watch execution.

<string> enum
Values: simulate force_simulate execute force_execute skip
alternative_input map string to object

When present, the watch uses this object as a payload instead of executing its own input.

ignore_condition boolean · default: false

When set to true, the watch execution uses the always condition. This can also be specified as an HTTP parameter.

record_execution boolean · default: false

When set to true, the watch record representing the watch execution result is persisted to the .watcher-history index for the current time. In addition, the status of the watch is updated, possibly throttling subsequent runs. This can also be specified as an HTTP parameter.

simulated_actions object
actions string[] required
all object required
Same fields as simulated_actions
use_all boolean required
trigger_data object

This structure is parsed as the data of the trigger event that will be used during the watch execution.

scheduled_time union oneOf required
One of: string or number
triggered_time union oneOf
One of: string or number
watch object · default: null

When present, this watch is used instead of the one specified in the request. This watch is not persisted to the index and record_execution cannot be set.

actions map string to object required
<string> object
action_type enum
Values: email webhook index logging slack pagerduty
condition object
always object
array_compare map string to object · min properties: 1 · max properties: 1
<string> object
path string required
compare map string to string to oneOf · min properties: 1 · max properties: 1
<string> map string to oneOf · min properties: 1 · max properties: 1
never object
script object
lang union anyOf · default: painless

Supported values include:

  • painless: Painless scripting language, purpose-built for Elasticsearch.
  • expression: Lucene’s expressions language, compiles a JavaScript expression to bytecode.
  • mustache: Mustache templated, used for templates.
  • java: Expert Java API
Values: painless expression mustache java
params map string to object
source union oneOf
One of:
id string
foreach string
max_iterations number
name string
throttle_period string
throttle_period_in_millis number
transform object
chain object[]
Same fields as transform in actions
script object
lang string · default: painless
params map string to object
source union oneOf
One of:
id string
request object required
body object
aggregations map string to {} Aggregation

Defines the aggregations that are run as part of the search request.

collapse object

Collapses search results the values of the specified field.

Same fields as collapse in SearchRequestBody
explain boolean · default: false

If true, the request returns detailed information about score computation as part of a hit.

ext map string to object

Configuration of search extensions defined by Elasticsearch plugins.

from number · default: 0

The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.

highlight object

Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.

Same fields as highlight in inner_hits
Reference
track_total_hits boolean | number · default: 10000

Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query.

indices_boost string to number[]

Boost the _score of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than 1.0 increases the score. A boost value between 0 and 1.0 decreases the score.

Reference
docvalue_fields object[]

An array of wildcard (*) field patterns. The request returns doc values for field names matching these patterns in the hits.fields property of the response.

Reference
field string required

A wildcard pattern. The request returns values for field names matching this pattern.

format string

The format in which the values are returned.

include_unmapped boolean
knn union oneOf

The approximate kNN search to run.

object or object[]
Same options as knn in SearchRequestBody
Reference
rank object

The Reciprocal Rank Fusion (RRF) to use.

rrf object

The reciprocal rank fusion parameters

Reference
rank_constant number

How much influence documents in individual result sets per query have over the final ranked result set

rank_window_size number

Size of the individual result sets per query

min_score number

The minimum _score for matching documents. Documents with a lower _score are not included in search results or results collected by aggregations.

post_filter {} Query

Use the post_filter parameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results.

profile boolean · default: false

Set to true to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution.

Reference
query {} Query

The search definition using the Query DSL.

rescore union oneOf

Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the query and post_filter phases.

object or object[]
Same options as rescore in SearchRequestBody
Reference
retriever object

A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as query and knn.

Same fields as retriever in SearchRequestBody
Reference
script_fields map string to object

Retrieve a script evaluation (based on different fields) for each hit.

<string> object
script string required
ignore_failure boolean
search_after union[]

Used to retrieve the next page of hits using a set of sort values from the previous page.

Reference
size number · default: 10

The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after property.

slice object

Split a scrolled search into multiple slices that can be consumed independently.

Reference
field string
id string required
max number required
sort union oneOf

A comma-separated list of

Same options as sort in inner_hits
Reference
_source union oneOf

The source fields that are returned for matching documents. These fields are returned in the hits._source property of the search response. If the stored_fields property is specified, the _source property defaults to false. Otherwise, it defaults to true.

One of:
Reference
fields object[]

An array of wildcard (*) field patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.

field string required

A wildcard pattern. The request returns values for field names matching this pattern.

format string

The format in which the values are returned.

include_unmapped boolean
suggest object

Defines a suggester that provides similar looking terms based on a provided text.

Reference
text string

Global suggest text, to avoid repetition when the same text is used in several suggesters

terminate_after number · default: 0

The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.

Important

Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.

If set to 0 (default), the query does not terminate early.

timeout string

The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.

track_scores boolean · default: false

If true, calculate and return document scores, even if the scores are not used for sorting.

version boolean · default: false

If true, the request returns the document version as part of a hit.

seq_no_primary_term boolean

If true, the request returns sequence number and primary term of the last modification of each hit.

Reference
stored_fields union oneOf

A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the _source property defaults to false. You can pass _source: true to return both source fields and stored fields in the search response.

One of: string[] or string
Reference
pit object

Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an <index> in the request path.

id string required
keep_alive string
runtime_mappings object

One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.

Reference
stats string[]

The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.

indices union oneOf
One of: string[] or string
indices_options object
allow_no_indices boolean

A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.

expand_wildcards union oneOf

Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden.

Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.
Values: all open closed hidden none
ignore_unavailable boolean · default: false

If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.

ignore_throttled boolean · default: true

If true, concrete, expanded or aliased indices are ignored when frozen.

search_type enum

Supported values include:

  • query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate.
  • dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
Values: query_then_fetch dfs_query_then_fetch
template object
explain boolean · default: false
id string

ID of the search template to use. If no source is specified, this parameter is required.

lang union anyOf · default: mustache

The language the template is written in. It is reported in the resolved search input of a watch record.

Supported values include:

  • painless: Painless scripting language, purpose-built for Elasticsearch.
  • expression: Lucene’s expressions language, compiles a JavaScript expression to bytecode.
  • mustache: Mustache templated, used for templates.
  • java: Expert Java API
Values: painless expression mustache java
params map string to object
profile boolean · default: false
source string

An inline search template. Supports the same parameters as the search API's request body. Also supports Mustache variables. If no id is specified, this parameter is required.

rest_total_hits_as_int boolean
timeout string
index object
index string
doc_id string
refresh enum
Values: true false wait_for
op_type enum · default: index

Supported values include:

  • index: Overwrite any documents that already exist.
  • create: Only index documents that do not already exist.
Values: index create
timeout string · default: 60s
execution_time_field string
logging object
level string
text string required
category string
email object
id string
bcc union string | string[]
body object
html string
text string
cc union string | string[]
from string
priority enum
Values: lowest low normal high highest
reply_to union string | string[]
sent_date union oneOf
One of: string or number
subject string required
to union string | string[] required
attachments map string to object
<string> object · min properties: 1 · max properties: 1
http object
content_type string
inline boolean
request object
auth object
basic object required
password string required
username string required
body string
connection_timeout string
headers map string to string
host string
method enum
Values: head get post put delete
params map string to string
path string
port number
proxy object
host string required
port number required
read_timeout string
scheme enum
Values: http https
url string
reporting object
url string required
inline boolean
retries number · default: 40
interval string · default: 15s
request object
Same fields as request in http
data object
format enum
Values: json yaml
pagerduty object
account string
attach_payload boolean required
client string
client_url string
contexts object[]
href string
src string
type enum required
Values: link image
description string required
event_type enum · default: trigger
Values: trigger resolve acknowledge
incident_key string required
proxy object
host string
port number
slack object
account string
message object required
attachments object[] required
author_icon string
author_name string required
color string
fallback string
fields object[]
short boolean required
title string required
value string required
image_url string
pretext string
text string
thumb_url string
title string required
ts number
dynamic_attachments object
attachment_template object required
Same fields as attachments in message
list_path string required
from string required
icon string
text string required
to string[] required
webhook object
auth object
basic object required
password string required
username string required
body string
connection_timeout string
headers map string to string
host string
method enum
Values: head get post put delete
params map string to string
path string
port number
proxy object
host string required
port number required
read_timeout string
scheme enum
Values: http https
url string
condition object
always object
array_compare map string to object · min properties: 1 · max properties: 1
<string> object
path string required
compare map string to string to oneOf · min properties: 1 · max properties: 1
<string> map string to oneOf · min properties: 1 · max properties: 1
never object
script object
lang union anyOf · default: painless

Supported values include:

  • painless: Painless scripting language, purpose-built for Elasticsearch.
  • expression: Lucene’s expressions language, compiles a JavaScript expression to bytecode.
  • mustache: Mustache templated, used for templates.
  • java: Expert Java API
Values: painless expression mustache java
params map string to object
source union oneOf
Same options as source in script
id string
input object required
chain object
inputs string to object[] required
Same fields as input in watch
http object
extract string[]
request object
Same fields as request in http
response_content_type enum
Values: json yaml text
extract string[]
request object required
Same fields as request in search
timeout string
simple map string to object
transform object
Same fields as transform in actions
metadata object
status object
actions object required
last_checked union oneOf
One of: string or number
last_met_condition union oneOf
One of: string or number
state object required
active boolean required
timestamp union oneOf required
One of: string or number
version number required
execution_state string
throttle_period string
throttle_period_in_millis number
transform object
Same fields as transform in actions
trigger object required
schedule object
timezone string
cron string
daily object
at union oneOf[] required
One of:
hourly object
minute number[] required
interval string
monthly union oneOf
object or object[]
at string[] required
on number[] required
weekly union oneOf
object or object[]
at string[] required
on enum[] required
Values: sunday monday tuesday wednesday thursday friday saturday
yearly union oneOf
object or object[]
at string[] required
int enum[] required
Values: january february march april may june july august september october november december
on number[] required

Response

application/json
_id string required

The watch record identifier as it would be stored in the .watcher-history index.

watch_record object required

The watch record document as it would be stored in the .watcher-history index.

@timestamp union oneOf required
One of: string or number
node string required
state enum required
Values: awaits_execution checking execution_not_needed throttled executed failed deleted_while_queued not_executed_already_queued
trigger_event object required
manual object required
schedule object
scheduled_time union oneOf required
One of: string or number
triggered_time union oneOf
One of: string or number
triggered_time union oneOf required
One of: string or number
type string required
watch_id string required
condition object
Same fields as condition in watch
input object
Same fields as input in watch
metadata object
result object
actions object[] required
email object
account string
message object required
id string
bcc union string | string[]
body object
html string
text string
cc union string | string[]
from string
priority enum
Values: lowest low normal high highest
reply_to union string | string[]
sent_date union oneOf
One of: string or number
subject string required
to union string | string[] required
attachments map string to object
<string> object · min properties: 1 · max properties: 1
http object
Same fields as http in attachments
reporting object
url string required
inline boolean
retries number · default: 40
interval string · default: 15s
request object
Same fields as request in http
data object
format enum
Values: json yaml
reason string
index object
response union oneOf

The outcome of the index operation. A single summary is returned when a single document is indexed, or an array when several documents are indexed at once. When a bulk operation ends in failure or partial_failure, the array includes failed items.

object or object[]
id string required
index string required
created boolean
result enum
Values: created updated deleted not_found noop
version number
failed boolean

Only present for failed items

message string

Only present for failed items

request object

The request that would have been executed. It is only present when the action is simulated.

doc_id string
index string required
refresh enum
Values: true false wait_for
source object required
logging object
logged_text string required
pagerduty object
event object required
account string
attach_payload boolean required
client string
client_url string
contexts object[]
href string
src string
type enum required
Values: link image
description string required
event_type enum · default: trigger
Values: trigger resolve acknowledge
incident_key string required
proxy object
host string
port number
reason string
request object
auth object
basic object required
password string required
username string required
body string
connection_timeout string
headers map string to string
host string
method enum
Values: head get post put delete
params map string to string
path string
port number
proxy object
host string required
port number required
read_timeout string
scheme enum
Values: http https
url string
response object
body string required
headers object required
status number required
slack object
account string
message object required
Same fields as message in slack
webhook object
request object required
Same fields as request in pagerduty
response object
body string required
headers object required
status number required
error object
type string required

The type of error

reason union string nullable

A human-readable explanation of the error, in English.

One of: string
stack_trace string

The server stack trace. Present only if the error_trace=true parameter was sent with the request.

caused_by object
Same fields as error in actions
root_cause object[]
Same fields as error in actions
suppressed object[]
Same fields as error in actions
reason string
id string required
type enum required
Values: email webhook index logging slack pagerduty
status enum required
Values: success failure partial_failure acknowledged throttled condition_failed simulated
condition object
met boolean required
status enum required
Values: success failure
type enum required
Values: always never script compare array_compare
compare object
resolved_values map string to object
array_compare object
resolved_values map string to object
transform object
payload map string to object
status enum required
Values: success failure
type enum required
Values: script search chain
request object required
Same fields as request in search
error object
type string required

The type of error

reason union string nullable

A human-readable explanation of the error, in English.

One of: string
stack_trace string

The server stack trace. Present only if the error_trace=true parameter was sent with the request.

caused_by object
Same fields as error in transform
root_cause object[]
Same fields as error in transform
suppressed object[]
Same fields as error in transform
reason string
foreach object[]
email object
Same fields as email in actions
index object
Same fields as index in actions
logging object
logged_text string required
pagerduty object
Same fields as pagerduty in actions
slack object
account string
message object required
Same fields as message in slack
webhook object
request object required
Same fields as request in pagerduty
response object
body string required
headers object required
status number required
error object
type string required

The type of error

reason union string nullable

A human-readable explanation of the error, in English.

One of: string
stack_trace string

The server stack trace. Present only if the error_trace=true parameter was sent with the request.

caused_by object
Same fields as error in foreach
root_cause object[]
Same fields as error in foreach
suppressed object[]
Same fields as error in foreach
reason string
max_iterations number
number_of_actions_executed number
condition object
met boolean required
status enum required
Values: success failure
type enum required
Values: always never script compare array_compare
compare object
resolved_values map string to object
array_compare object
resolved_values map string to object
execution_duration number required
execution_time union oneOf required
One of: string or number
input object
payload map string to object
status enum required
Values: success failure
type enum required
Values: chain http none search simple transform

The resolved search request, present when the input is a search input.

request object required
Same fields as request in search
http object

The resolved HTTP request, present when the input is an HTTP input.

request object required
Same fields as request in pagerduty
status_code number

The HTTP status code returned by the request. It is only present when the request was executed.

chain map string to object

The result of each named input, present when the input is a chain input.

error object
type string required

The type of error

reason union string nullable

A human-readable explanation of the error, in English.

One of: string
stack_trace string

The server stack trace. Present only if the error_trace=true parameter was sent with the request.

caused_by object
Same fields as error in input
root_cause object[]
Same fields as error in input
suppressed object[]
Same fields as error in input
transform object
Same fields as transform in actions
user string
status object
actions object required
last_checked union oneOf
One of: string or number
last_met_condition union oneOf
One of: string or number
state object required
active boolean required
timestamp union oneOf required
One of: string or number
version number required
execution_state string
messages string[]
vars map string to object
exception object
type string required

The type of error

reason union string nullable

A human-readable explanation of the error, in English.

One of: string
stack_trace string

The server stack trace. Present only if the error_trace=true parameter was sent with the request.

caused_by object
Same fields as exception in watch_record
root_cause object[]
Same fields as exception in watch_record
suppressed object[]
Same fields as exception in watch_record