Watcher configuration to detect one or more slow requests.

slow_requests_watch

{
  "trigger": {
    "schedule": {
      "interval": "20s"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": ["logstash-*"],
        "body": {
          "query": {
            "filtered": {
              "query": {
                "query_string": {
                  "query": "slow_requests",
                  "analyze_wildcard": true
                }
              },
              "filter": {
                "bool": {
                  "must": [{
                    "range": {
                      "@timestamp": {
                        "gte": "now-20s"
                      }
                    }
                  }],
                  "must_not": []
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": { "gte": 1 }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "to": "your@email.com",
        "subject": "Multiple slow requests",
        "body": "The /healt-check endpoint is responding to slow."
      }
    }
  }
}