Elasticsearch Watcher (Alert) to index payload to a new one via index action and add a new field using a webhook

elasticsearch_watcher_action_index_add_field_webhook.md

{
  "trigger": {
    "schedule": {
      "interval": "10s"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "kibana_sample*"
        ],
        "types": [],
        "body": {
          "query": {
            "match_all":{}
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 10
      }
    }
  },
  "actions": {
    "index_payload": {
      "index": {
        "index": "kibana_watcher",
        "doc_type": "_doc",
        "execution_time_field": "timestamp"
      }
    },
    "add_field_webhook": {
      "webhook": {
        "scheme": "http",
        "host": "localhost",
        "port": 9200,
        "method": "post",
        "path": "kibana_watcher/_update_by_query",
        "params": {},
        "headers": {},
        "auth": {
          "basic": {
            "username": "elastic",
            "password": "::es_redacted::"
          }
        },
        "body": "{\"script\" : {\"inline\": \"ctx._source.new_field = 'my new field' \"}}"
      }
    }
  }
}