watcher examples .txt

### EXAMPLE SEARCH: Has Spotify run in the last 30 seconds?
GET /topbeat-*/_search
{
  "query": {
    "bool": {
      "must": [
        {"term": {
          "proc.name": {
            "value": "Spotify"
          }
        }},
        {"range": {
          "@timestamp": {
            "gte": "now-30s"
          }
        }}
      ]
    }
  }
}  
  
### Clear the spotify watch
DELETE /_watcher/watch/spotify_watch


### Insert the spotify watch with email action
PUT /_watcher/watch/spotify_watch
{ 
  "trigger" : {	
    "schedule" : { "interval" : "10s" }  
  }, 
  "input" : {	
    "search" : {  	
      "request" : {    	
        "indices" : [ "topbeat-*" ],    	
        "body" : {
          "query": {
            "bool": {
              "must": [
                {"term": {
                  "proc.name": {
                    "value": "Spotify"
                  }
                }},
                {"range": {
                  "@timestamp": {
                    "gte": "now-30s"
                  }
                }}
              ]
            }
          }
        }   
      }     
    }	
  }, 
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  },
  "actions" : {	
    "email_administrator" : {  
      "throttle_period": "1m",	
        "email" : {    	
          "to" : "dave@elastic.co",    	
          "subject" : "Dave is listening to spotify at work",    	
          "body" : "sent from watcher"  	
       }         
    } 
  }
}

### Insert the spotify watch with Slack action
PUT /_watcher/watch/spotify_watch
{ 
  "trigger" : {	
    "schedule" : { "interval" : "10s" }  
  }, 
  "input" : {	
    "search" : {  	
      "request" : {    	
        "indices" : [ "topbeat-*" ],    	
        "body" : {
          "query": {
            "bool": {
              "must": [
                {"term": {
                  "proc.name": {
                    "value": "Spotify"
                  }
                }},
                {"range": {
                  "@timestamp": {
                    "gte": "now-30s"
                  }
                }}
              ]
            }
          }
        }   
      }     
    }	
  }, 
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  },
  "actions" : {
    "notify-slack" : {
      "throttle_period" : "1m",
      "slack" : {
        "account": "monitoring",
        "message" : {
          "to" : [ "#davealerts" ], 
          "text" : "Encountered  {{ctx.payload.hits.total}} Topbeat mentions of Spotify in the last 30 seconds: http://localhost:5601/app/kibana#/dashboard/Topbeat-Dashboard " 
        }
      }
    }
  }
}