Alerting and notifications in Elasticsearch - Step-by-Step Execution

Concept Flow - Alerting and notifications

Define Watch

↓

Set Trigger Condition

↓

Monitor Data

↓

Condition Met?

No→Wait

Yes↓

Execute Actions

↓

Send Notifications

↓

End or Repeat

This flow shows how an alert is set up, monitors data, checks conditions, and sends notifications when triggered.

Execution Sample

Elasticsearch

PUT _watcher/watch/error_watch
{
  "trigger": { "schedule": { "interval": "10s" } },
  "input": { "search": { "request": { "indices": ["logs"], "body": { "query": { "match": { "level": "error" } } } } } },
  "condition": { "compare": { "ctx.payload.hits.total.value": { "gt": 0 } } },
  "actions": { "email_admin": { "email": { "to": "[e-mail]", "subject": "Error Logs Alert", "body": "There are error logs in the last 10 seconds." } } }
}

This watch checks every 10 seconds for error logs and sends an email if any are found.

Execution Table

Step	Action	Evaluation	Result
1	Trigger fires every 10 seconds	Time reached	Proceed to input search
2	Search logs index for 'level: error'	Query executed	Hits found: 3
3	Check condition 'hits.total.value > 0'	3 > 0	True
4	Execute action: send email	Email sent to [e-mail]	Notification sent
5	Wait for next trigger	Next 10 seconds	Cycle repeats
6	Trigger fires again	Time reached	Proceed to input search
7	Search logs index for 'level: error'	Query executed	Hits found: 0
8	Check condition 'hits.total.value > 0'	0 > 0	False
9	No action executed	No notification	Wait for next trigger

💡 Execution cycles continuously every 10 seconds, sending notifications only when condition is true.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 7	After Step 8
hits.total.value	0	3	3	3	0	0
condition_met	false	N/A	true	true	N/A	false
notification_sent	false	false	false	true	false	false

Key Moments - 3 Insights

Why does the watch send an email only sometimes?

Because the condition 'hits.total.value > 0' is only true when error logs exist (see execution_table rows 3 and 8). When no errors are found, the condition is false and no email is sent.

What triggers the watch to run its check?

The watch runs every 10 seconds as defined by the trigger schedule (execution_table rows 1 and 6). This periodic trigger initiates the search and condition evaluation.

What happens if the search finds zero error logs?

The condition evaluates to false (execution_table row 8), so no actions like sending emails are executed (row 9). The watch waits for the next trigger cycle.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'hits.total.value' after step 2?

A 3

B 0

C undefined

D 10

💡 Hint

Check the 'hits.total.value' variable in variable_tracker after Step 2.

At which step does the condition evaluate to false?

A Step 3

B Step 8

C Step 4

D Step 2

💡 Hint

Look at the 'Condition' column in execution_table rows where condition is checked.

If the trigger interval changed to 30 seconds, how would the execution table change?

A Steps would occur every 30 seconds instead of 10

B Condition would never be true

C Emails would be sent more frequently

D Search would look in a different index

💡 Hint

Refer to the trigger action timing in execution_table steps 1 and 6.

Concept Snapshot

Alerting in Elasticsearch uses watches.
A watch has a trigger (time-based), input (data query), condition (checks data), and actions (notifications).
When the condition is true, actions like emails are sent.
Watches run repeatedly as scheduled.
This helps monitor data and alert on important events.

Full Transcript

This visual execution shows how Elasticsearch alerting works using watches. First, a watch is defined with a trigger that runs every 10 seconds. When triggered, it searches the logs index for error-level logs. The condition checks if any error logs exist. If yes, an email notification is sent to the admin. The watch then waits for the next trigger cycle. If no errors are found, no notification is sent. Variables like hits.total.value track the number of errors found. The condition_met variable shows if the alert condition is true. The notification_sent variable tracks if an email was sent. This cycle repeats continuously, enabling real-time alerting based on data changes.