Watcher is an Elasticsearch feature that you can use to create actions based on conditions, which are periodically evaluated using queries on your data. Watches are helpful for analyzing mission-critical and business-critical streaming data. For example, you might watch application logs for performance outages or audit access logs for security threats.


Watcher examples

Watcher job to integrate ChatGPT in Elasticsearch

Watcher job to integrate ChatGPT API from OpenAI in Elasticsearch. Helpful to find solutions for error messages very quick.

Move to next ILM phase Watcher

This watcher job is moving specific indices based on e.g. disc usage into the next ILM phase.

Kibana alerting enhancement

This bundle enhances the Kibana alerting experience. Storing all relevant information in indices and visualize the data in dashboards.

Watcher History Dashboard

This dashboard shows the history of executed watcher jobs.

Watch to detect large shards

This watch is getting data from the Elasticsearch shards API directly and checking for large shards.

Watch for changes in IOWaits

A watch which alerts if the time spent by a hosts CPU in IOWait, has increased by more than than N% in the last Y mins.

Uptime watch using Heartbeat data

This watch checks the availability of your Heartbeat observed services. It will trigger an alert whenever at least one of your services is down.


More about Watcher

Using Watcher in Elasticsearch helps to automate tasks and analyses the data that is store in the Elastic Stack. This is one element of the alerting features within the ELK stack.