Managing watches
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Generally available
Watcher provides as set of APIs you can use to manage your watches:
- Use the create or update watch API to add or update watches
- Use the get watch API to retrieve watches
- Use the delete watch API to delete watches
- Use the activate watch API to activate watches
- Use the deactivate watch API to deactivate watches
- Use the ack watch API to acknowledge watches
Currently there is no dedicated API for listing the stored watches. However, since Watcher stores its watches in the .watches index, you can list them by executing a search on this index.
You can only perform read actions on the .watches index. You must use the Watcher APIs to create, update, and delete watches. If Elasticsearch security features are enabled, we recommend you only grant users read privileges on the .watches index.
For example, the following returns the first 100 watches:
GET /_watcher/_query/watches{ "size" : 100 }