Watchers workshop

gistfile1.txt

PUT /log
{
  "mappings": {
    "log": {
      "properties": {
        "host": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}


PUT /log/log/1
{
  "host":"damiler-1",
  "@timestamp":"2016-07-07T12:00:00.000Z"
}

PUT /log/log/2
{
  "host":"damiler-2",
  "@timestamp":"2016-07-07T12:00:00.000Z"
}

PUT /log/log/3
{
  "host":"damiler-3",
  "@timestamp":"2016-07-07T13:00:00.000Z"
}

PUT /log/log/1a
{
  "host":"damiler-1",
  "@timestamp":"2016-07-07T13:27:00.000Z"
}

PUT /log/log/2a
{
  "host":"damiler-2",
  "@timestamp":"2016-07-07T13:27:00.000Z"
}


PUT /log/log/3a
{
  "host":"damiler-2",
  "@timestamp":"2016-07-07T13:25:00.000Z"
}



GET /log/log/_search
{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-24h"
      }
    }
  },
  "aggs": {
    "periods": {
      "filters": {
        "filters": {
          "history": {
            "range": {
              "@timestamp": {
                "gte": "now-24h"
              }
            }
          },
          "last_period": {
            "range": {
              "@timestamp": {
                "gte": "now-5m"
              }
            }
          }
        }
      },
      "aggs": {
        "hosts": {
          "terms": {
            "field": "host",
            "size": 10000
          }
        }
      }
    }
  },
  "size": 0
}


PUT _watcher/watch/detect_system_not_reporting
{
  "metadata": {
    "window_period": "24h",
    "last_period":"5m"
  },
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": "log",
        "types": "log",
        "body": {
          "query": {
            "range": {
              "@timestamp": {
                "gte": "now-{{ctx.metadata.window_period}}"
              }
            }
          },
          "aggs": {
            "periods": {
              "filters": {
                "filters": {
                  "history": {
                    "range": {
                      "@timestamp": {
                        "gte": "now-{{ctx.metadata.window_period}}"
                      }
                    }
                  },
                  "last_period": {
                    "range": {
                      "@timestamp": {
                        "gte": "now-{{ctx.metadata.last_period}}"
                      }
                    }
                  }
                }
              },
              "aggs": {
                "hosts": {
                  "terms": {
                    "field": "host",
                    "size": 10000
                  }
                }
              }
            }
          },
          "size": 0
        }
      }
    }
  },
  "condition": {
    "script": {
      "inline": "return ctx.payload.aggregations.periods.buckets.history.hosts.buckets.size() > ctx.payload.aggregations.periods.buckets.last_period.hosts.buckets.size();"
    }
  },
  "throttle_period": "5m",
  "actions": {
    "log": {
      "transform": {
      "script": "history=ctx.payload.aggregations.periods.buckets.history.hosts.buckets.collect({it.key}); last_period=ctx.payload.aggregations.periods.buckets.last_period.hosts.buckets.collect({it.key}); history.intersect(last_period).each({history.remove(it)}); return history;"
    },
      "logging": {
        "text": "Systems not responding in the last {{ctx.metadata.last_period}} minutes: \n{{#ctx.payload._value}}{{.}}\n\n{{/ctx.payload._value}}"
      }
    }
  }
}