Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
### EXAMPLE SEARCH: Has Spotify run in the last 30 seconds?
GET /topbeat-*/_search
{
"query": {
"bool": {
"must": [
{"term": {
"proc.name": {
"value": "Spotify"
}
}},
{"range": {
"@timestamp": {
"gte": "now-30s"
}
}}
]
}
}
}
### Clear the spotify watch
DELETE /_watcher/watch/spotify_watch
### Insert the spotify watch with email action
PUT /_watcher/watch/spotify_watch
{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "topbeat-*" ],
"body" : {
"query": {
"bool": {
"must": [
{"term": {
"proc.name": {
"value": "Spotify"
}
}},
{"range": {
"@timestamp": {
"gte": "now-30s"
}
}}
]
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email_administrator" : {
"throttle_period": "1m",
"email" : {
"to" : "dave@elastic.co",
"subject" : "Dave is listening to spotify at work",
"body" : "sent from watcher"
}
}
}
}
### Insert the spotify watch with Slack action
PUT /_watcher/watch/spotify_watch
{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "topbeat-*" ],
"body" : {
"query": {
"bool": {
"must": [
{"term": {
"proc.name": {
"value": "Spotify"
}
}},
{"range": {
"@timestamp": {
"gte": "now-30s"
}
}}
]
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"notify-slack" : {
"throttle_period" : "1m",
"slack" : {
"account": "monitoring",
"message" : {
"to" : [ "#davealerts" ],
"text" : "Encountered {{ctx.payload.hits.total}} Topbeat mentions of Spotify in the last 30 seconds: http://localhost:5601/app/kibana#/dashboard/Topbeat-Dashboard "
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.