Query watches

  • POST also GET /_watcher/_query/watches
Auth

Get all registered watches in a paginated manner and optionally filter watches by a query.

Note that only the _id and metadata.* fields are queryable or sortable.

Required authorization

Cluster privileges monitor_watcher

Request body

from number · default: 0

The offset from the first result to fetch. It must be non-negative.

size number · default: 10

The number of hits to return. It must be non-negative.

query {} Query

A query that filters the watches to be returned.

sort union oneOf

One or more fields used to sort the search results.

Reference
A value or an array; each item is one of:

Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

search_after union[]

Retrieve the next page of hits using a set of sort values from the previous page.

Reference

Response

application/json
count number required

The total number of watches found.

watches object[] required

A list of watches based on the from, size, or search_after request body parameters.

_id string required
status object
actions object required
last_checked union oneOf
One of: string or number
last_met_condition union oneOf
One of: string or number
state object required
active boolean required
timestamp union oneOf required
One of: string or number
version number required
execution_state string
watch object
actions map string to object required
<string> object
action_type enum
Values: email webhook index logging slack pagerduty
condition object
always object
array_compare map string to object · min properties: 1 · max properties: 1
<string> object
path string required
compare map string to string to oneOf · min properties: 1 · max properties: 1
<string> map string to oneOf · min properties: 1 · max properties: 1
never object
script object
lang string · default: painless
params map string to object
source string
id string
foreach string
max_iterations number
name string
throttle_period string
throttle_period_in_millis number
transform object
chain object[]
Same fields as transform in actions
script object
lang string · default: painless
params map string to object
source string
id string
request object required
body object
query {} Query required
indices string[]
indices_options object
allow_no_indices boolean

If false, the request returns an error if any wildcard expression, index alias, or _all value targets only missing or closed indices. This behavior applies even if the request targets other open indices. For example, a request targeting foo*,bar* returns an error if an index starts with foo but no index starts with bar.

expand_wildcards union oneOf

Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden.

Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.
Values: all open closed hidden none
ignore_unavailable boolean · default: false

If true, missing or closed indices are not included in the response.

ignore_throttled boolean · default: true

If true, concrete, expanded or aliased indices are ignored when frozen.

search_type enum

Supported values include:

  • query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate.
  • dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
Values: query_then_fetch dfs_query_then_fetch
template object
explain boolean · default: false
id string

ID of the search template to use. If no source is specified, this parameter is required.

params map string to object
profile boolean · default: false
source string

An inline search template. Supports the same parameters as the search API's request body. Also supports Mustache variables. If no id is specified, this parameter is required.

rest_total_hits_as_int boolean
timeout string required
index object
index string required
doc_id string
refresh enum
Values: true false wait_for
op_type enum · default: index

Supported values include:

  • index: Overwrite any documents that already exist.
  • create: Only index documents that do not already exist.
Values: index create
timeout string · default: 60s
execution_time_field string
logging object
level string
text string required
category string
email object
id string
bcc union string | string[]
body object
html string
text string
cc union string | string[]
from string
priority enum
Values: lowest low normal high highest
reply_to union string | string[]
sent_date union oneOf
One of: string or number
subject string required
to union string | string[] required
attachments map string to object
<string> object · min properties: 1 · max properties: 1
http object
content_type string
inline boolean
request object
auth object
basic object required
password string required
username string required
body string
connection_timeout string
headers map string to string
host string
method enum
Values: head get post put delete
params map string to string
path string
port number
proxy object
host string required
port number required
read_timeout string
scheme enum
Values: http https
url string
reporting object
url string required
inline boolean
retries number · default: 40
interval string · default: 15s
request object
Same fields as request in http
data object
format enum
Values: json yaml
pagerduty object
account string
attach_payload boolean required
client string
client_url string
contexts object[]
href string
src string
type enum required
Values: link image
description string required
event_type enum · default: trigger
Values: trigger resolve acknowledge
incident_key string required
proxy object
host string
port number
slack object
account string
message object required
attachments object[] required
author_icon string
author_name string required
color string
fallback string
fields object[]
short boolean required
title string required
value string required
image_url string
pretext string
text string
thumb_url string
title string required
ts number
dynamic_attachments object
attachment_template object required
Same fields as attachments in message
list_path string required
from string required
icon string
text string required
to string[] required
webhook object
auth object
basic object required
password string required
username string required
body string
connection_timeout string
headers map string to string
host string
method enum
Values: head get post put delete
params map string to string
path string
port number
proxy object
host string required
port number required
read_timeout string
scheme enum
Values: http https
url string
condition object required
Same fields as condition in actions
input object required
chain object
inputs string to object[] required
Same fields as input in watch
http object
extract string[]
request object
Same fields as request in http
response_content_type enum
Values: json yaml text
extract string[]
request object required
Same fields as request in search
timeout string
simple map string to object
metadata object
status object
actions object required
last_checked union oneOf
One of: string or number
last_met_condition union oneOf
One of: string or number
state object required
active boolean required
timestamp union oneOf required
One of: string or number
version number required
execution_state string
throttle_period string
throttle_period_in_millis number
transform object
Same fields as transform in actions
trigger object required
schedule object
timezone string
cron string
daily object
at union oneOf[] required
One of:
hourly object
minute number[] required
interval string
monthly union oneOf
object or object[]
at string[] required
on number[] required
weekly union oneOf
object or object[]
at string[] required
on enum[] required
Values: sunday monday tuesday wednesday thursday friday saturday
yearly union oneOf
object or object[]
at string[] required
int enum[] required
Values: january february march april may june july august september october november december
on number[] required
_primary_term number
_seq_no number