Type to search.

Run a watch

  • POST also PUT /_watcher/watch/{id}/_execute
  • POST also PUT /_watcher/watch/_execute
Auth

This API can be used to force execution of the watch outside of its triggering logic or to simulate the watch execution for debugging purposes.

For testing and debugging purposes, you also have fine-grained control on how the watch runs. You can run the watch without running all of its actions or alternatively by simulating them. You can also force execution by ignoring the watch condition and control whether a watch record would be written to the watch history after it runs.

You can use the run watch API to run watches that are not yet registered by specifying the watch definition inline. This serves as great tool for testing and debugging your watches prior to adding them to Watcher.

When Elasticsearch security features are enabled on your cluster, watches are run with the privileges of the user that stored the watches. If your user is allowed to read index a, but not index b, then the exact same set of rules will apply during execution of a watch.

When using the run watch API, the authorization data of the user that called the API will be used as a base, instead of the information who stored the watch.

Required privileges

Cluster privileges manage_watcher

Path parameters

id string optional

The watch identifier.

Leave it out to use /_watcher/watch/_execute.

Query parameters

debug boolean · default: false

Defines whether the watch runs in debug mode.

Request body

action_modes map string to enum

Determines how to handle the watch actions as part of the watch execution.

<string> enum
Values: simulate force_simulate execute force_execute skip
alternative_input map string to object

When present, the watch uses this object as a payload instead of executing its own input.

ignore_condition boolean · default: false

When set to true, the watch execution uses the always condition. This can also be specified as an HTTP parameter.

record_execution boolean · default: false

When set to true, the watch record representing the watch execution result is persisted to the .watcher-history index for the current time. In addition, the status of the watch is updated, possibly throttling subsequent runs. This can also be specified as an HTTP parameter.

Response

application/json
_id string required

The watch record identifier as it would be stored in the .watcher-history index.

watch_record object required

The watch record document as it would be stored in the .watcher-history index.

condition object required
Same fields as condition in actions
input object required
Same fields as input in watch
messages string[] required
metadata object
node string required
result object required
actions object[] required
id string required
reason string
status enum required
Values: success failure simulated throttled
type enum required
Values: email webhook index logging slack pagerduty
condition object required
met boolean required
status enum required
Values: success failure simulated throttled
type enum required
Values: always never script compare array_compare
execution_duration number required
execution_time union oneOf required
One of: string or number
input object required
payload map string to object required
status enum required
Values: success failure simulated throttled
type enum required
Values: http search simple
state enum required
Values: awaits_execution checking execution_not_needed throttled executed failed deleted_while_queued not_executed_already_queued
trigger_event object required
manual object required
triggered_time union oneOf required
One of: string or number
type string required
user string required
watch_id string required