Alerting and notifications in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Watcher alert condition?

Given the following Watcher condition script, what will be the result if the document count is 5?

{
  "condition": {
    "script": {
      "source": "return ctx.payload.hits.total.value > 10"
    }
  }
}

Elasticsearch

{
  "condition": {
    "script": {
      "source": "return ctx.payload.hits.total.value > 10"
    }
  }
}

A false

B true

C null

D ScriptException

💡 Hint

Think about the comparison operator and the document count value.

The script checks if the total hits are greater than 10. Since the count is 5, the condition returns false.

🧠 Conceptual

intermediate

Which action type sends an email notification in Elasticsearch Watcher?

In Elasticsearch Watcher, which action type is used to send an email alert?

A "email"

B "webhook"

C "index"

D "logging"

💡 Hint

Think about the action that directly sends messages to email addresses.

The "email" action type is designed to send email notifications when a watch triggers.

❓ Predict Output

advanced

What is the output of this Watcher transform script?

Given this transform script in a Watcher action, what will be the output if ctx.payload.hits.hits contains two documents with fields {"status": "error"} and {"status": "ok"} respectively?

{
  "transform": {
    "script": {
      "source": "return ctx.payload.hits.hits.stream().filter(hit -> hit._source.status == 'error').collect(Collectors.toList())"
    }
  }
}

Elasticsearch

{
  "transform": {
    "script": {
      "source": "return ctx.payload.hits.hits.stream().filter(hit -> hit._source.status == 'error').collect(Collectors.toList())"
    }
  }
}

A [{"_source":{"status":"error"}}]

B [{"_source":{"status":"ok"}}]

C ScriptException

D []

💡 Hint

Consider the scripting language used by Watcher and Java stream API availability.

Watcher scripts use painless language, which does not support Java streams. This script will cause a ScriptException.

🔧 Debug

advanced

Why does this Watcher email action fail to send?

This Watcher email action configuration fails to send emails. What is the cause?

{
  "actions": {
    "send_email": {
      "email": {
        "to": "[e-mail]",
        "subject": "Alert",
        "body": "There is an alert."
      }
    }
  }
}

A Missing SMTP server configuration in Elasticsearch settings

B The "body" field must be an object with "text" key

C The "to" field must be an array, not a string

D Incorrect email action name, should be "email_action"

💡 Hint

Check the required structure of the email body in Watcher email actions.

The email body must be an object with a "text" key, not a plain string. This causes the failure.

🚀 Application

expert

How many actions will execute if this Watcher triggers?

Consider this Watcher with two actions defined:

{
  "actions": {
    "log_error": {
      "logging": {
        "level": "error",
        "text": "Error detected"
      }
    },
    "notify_admin": {
      "email": {
        "to": ["[e-mail]"],
        "subject": "Alert",
        "body": {"text": "An error occurred."}
      }
    }
  }
}

If the Watcher condition is true, how many actions will run?

A No actions run automatically; manual trigger required

B Only the second action "notify_admin" runs

C Only the first action "log_error" runs

D Both actions "log_error" and "notify_admin" run

💡 Hint

By default, all actions run if the condition is met.

When the condition is true, all defined actions execute unless throttled or disabled.