example_webhook_watch.txt

POST _watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "1m"
      }
    },
    "input": {
      "search": {
        "request": {
          "indices": [
            "kibana_sample_data_logs"
            ],
            "body": {
              "query": {
                "bool": {
                  "must": [
                    {
                      "query_string": {
                        "query": "error"
                      }
                    },
                    {
                      "range": {
                        "@timestamp": {
                          "gte": "now-1m"
                        }
                      }
                    }
                    ]
                }
              }
            }
        }
      }
    },
    "condition": {
      "compare": {
        "ctx.payload.hits.total": {
          "gte": 1
        }
      }
    },
    "actions" : {
      "create_otrs" : {
        "transform": {
          "script": """return ['Ticket':['Queue':'EngineeringTeam','Priority':'P3','CustomerUser':'root@localhost','Title':'RESTCreateTest','State':'new','Type':'Incident'],'Article':['ContentType':'text/plain;charset=utf8','Subject':'RestCreateTest','Body':'Thisisonlyatest']]"""
        },
        "webhook" : {
          "method" : "POST",
          "host" : "echo.zuplo.io",
          "scheme" : "https",
          "port": 443,
          "body": "{{#toJson}}ctx.payload{{/toJson}}",
          "auth" : {
            "basic" : {
              "username" : "myusername", 
              "password" : "mypassword"
            }
          }
        }
      }
    }
  }
}