Elastic Watcher Action Examples

In the 'action' section, you can print variables from the context ("ctx"), e.g.

    {{ ctx.payload.status }}

You can grab things from side aggregations:

    {{ ctx.payload.aggregations.myAggName.buckets.size }}

You can also loop across an aggregation:

    {{#ctx.payload.aggregations.myAggName.buckets}}
        {{key}}: {{doc_count}}
    {{/ctx.payload.aggregations.myAggName.buckets}}

The variables work (at least) in the email subject and body. Note that if you manage your watcher config via ansible and put these configs in templates, ansible will interpret the curly braces as jinja commands. To prevent this, wrap whem in {% raw %} / {% endraw %} pairs, e.g.:

    {% raw %}{{ ctx.payload.status }}{% endraw %}