Watcher

We use watcher to perform some actions based on certain conditions that we apply. Conditions are based on the index data that we send to the watch. This loaded data is known as Watch Payload, and it can be loaded from different sources, such as from Elasticsearch or from external HTTP service.

On the Management screen, we have the option of Watcher. Watcher does not come by default with Elastic stack and enables when we install X-Pack into Kibana and Elasticsearch:

The preceding screenshot displays a list of Watches that are running.

Watches have the following possible states:

• Firing: Watch is triggered and actively performing the actions
• Error: There is an error state and watch is not working properly
• Ok: Watch is working properly but not firing right now
• Disabled: Watch is disabled and not able to fire

Creating the watch

To create a watch, we need to click on the Create new watch button, which opens a dropdown with two values:

• Threshold alert: It is used to send the alerts on a specific...