A Watch is made of the following components:
- schedule: This is used to specify the time interval for scheduling/triggering the watch.
- query: Used to specify a query to retrieve data from Elasticsearch and run as input to the condition. Elasticsearch Query DSL/Lucene queries can be used to specify the queries.
- condition: This is used to specify conditions against the input data obtained from the query and check whether any action needs to be taken or not.
- action: This is used to specify actions such as sending an email, sending a slack notification, logging the event to a specific log, and much more on meeting the condition.
Let's look into a sample watch and understand the building blocks of a watch in detail. The following ...
