Watcher configuration to detect two or more HTTP 500 consecutive

500_watch

{
  "trigger": {
    "schedule": {
      "interval": "20s"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": ["logstash-*"],
        "body": {
          "query": {
            "filtered": {
              "query": {
                "query_string": {
                  "query": "@status:500",
                  "analyze_wildcard": true
                }
              },
              "filter": {
                "bool": {
                  "must": [{
                    "range": {
                      "@timestamp": {
                        "gte": "now-20s"
                      }
                    }
                  }],
                  "must_not": []
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": { "gt": 1 }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "to": "your@email.com",
        "subject": "Multiple 500 errors",
        "body": "The /healt-check endpoint receive {{ctx.payload.hits.total}} HTTP 500 consecutively."
      }
    }
  }
}