Use this pack to jump-start Elasticsearch Watcher proofs of concept with ready-made examples for operational monitoring, security activity, and behavioral changes in log data.
What is included
- Example Watcher definitions for cluster health, disk space, port scans, new processes, new user-server communication, account activity, social trends, and missing data.
- Matching mappings, sample test events, and Painless scripts used by the watches.
- Utility scripts for loading watches and running the included tests against an Elasticsearch cluster.
Who it helps
This download is useful for teams that want practical Watcher starting points instead of building alert logic from a blank page. The examples are designed for demos and POCs, so review thresholds, data assumptions, and notification actions before adapting them for production.
Compatibility
The upstream README states these examples assume Elasticsearch 6.2 with X-Pack Watcher. The package has been tagged as 6.x compatibility on this site.
Source and license
Source: elastic/examples Alerting Sample Watches. The upstream repository is licensed under Apache 2.0, and the license file is included in the ZIP.
| Tested versions | 6.x |
| ECS compliant | |
| Tested versions |
You must log in to submit a review.