Watcher index action

Watcher index action

Use the index action to index data into Elasticsearch. See Index action attributes for the supported attributes.

Configuring index actions

The following snippet shows a simple index action definition:

"actions" : {
  "index_payload" : { 
    "condition": { ... }, 
    "transform": { ... }, 
    "index" : {
      "index" : "my-index-000001", 
      "doc_id": "my-id" 
    }
  }
}

Index action attributes

Multi-document support

Like with all other actions, you can use a transform to replace the current execution context payload with another and by that change the document that will end up indexed.

The index action plays well with transforms with its support for the special _doc payload field.

When resolving the document to be indexed, the index action first looks up for a _doc field in the payload. When not found, the payload is indexed as a single document.

When a _doc field exists, if the field holds an object, it is extracted and indexed as a single document. If the field holds an array of objects, each object is treated as a document and the index action indexes all of them in a bulk.

An _index, or _id value can be added per document to dynamically set the index and ID of the indexed document.

The following snippet shows a multi-document index action definition:

"actions": {
  "index_payload": {
    "transform": {
      "script": """
      def documents = ctx.payload.hits.hits.stream()
        .map(hit -> [
          "_index": "my-index-000001", 
          "_id": hit._id, 
          "severity": "Sev: " + hit._source.severity 
        ])
        .collect(Collectors.toList());
      return [ "_doc" : documents]; 
      """
    },
    "index": {} 
  }
}