creating notifications through Alerting / Watcher X-Pack plugin on Elastic Cloud — Part 1

X-Pack Watcher / Alerting (remember this pair of eyes? :) )
  • Kibana UI for creating a Threshold watch AND
  • an Advanced watch

what is Watcher / Alerting?

from the official documentation:

the watcher UI

Let’s start with the quickest way to setup a watch through the kibana’s watcher UI.

threshold or advanced watch?
threshold watch page
options available
  • when: is the metrics to decide your data matches a condition, hence count, average, sum etc are available
  • over: is describing how to get a value for evaluation on the above metric; available options are overall (means all data without any filtering or grouping) or top (means top n VALUES of a field; where each VALUE contains its own count. For example, top 3 country names, so we might end up US: 1000, CN: 780, IN: 680 etc)
  • is above: is the number threshold / indicator, for example the count of documents over / above 10000, an action should be carried out (like email somebody). Available options are: above, above or equals, below, below or equals and is-between.
  • for the last: refers to the time range to collect the value for evaluation, it makes sense that we are talking about data within the last n minutes or hours instead of every data since day 1; so this is where we setup the query range criteria — default is past 5 minutes.
logging action

Housekeep issues

Congratulations~ You have just created a simple threshold watch using the Watcher UI. This 1st trial isn’t really that useful to us, plus every minute creating a log is not a good thing too. Let’s do some housekeeping, going back to the watcher UI, click on the targeted watch (for our case, the test_only watch), on the top right hand side of the history page, we can now deactivate or even delete the watch. I suggest to deactivate in general, since you never know when you would need to trigger the watch again. And That’s it~ So easy!

the dreaded Advance Watch…

Hey! Are you ready for some upgraded challenges? Let’s try out the Advance watch, shall we? (no? sorry… no choice for you, let’s go :) )

  • trigger: the triggering schedule which is set to 1 minute
  • input: the ways to get back data for evaluation, yep… it is bulky and you can guess I am trying to do a match_all query and get back all data from the imdb_movie index
  • condition: defining when an action should be triggered, in this case, if the total number of documents is over “2”, trigger the actions
  • actions: defining the notification actions if the above condition is met; again in this case, just a simple log to our cluster


Cool~ We have gone through some journey here:

  • Using watcher UI to create a threshold watch
  • also created an advanced watch
  • we also have an idea where to read our logs on Elastic Cloud



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
devops terminal

a java / golang / flutter developer, a big data scientist, a father :)