watcher的配置可参照：https://kibana.logstash.es/content/elasticsearch/other/watcher.html
-
SearchPhaseExecutionException[all shards failed]; nested: [Field data loading is forbidden on [filename]]; nested: IllegalStateException[Field data loading is forbidden on [filename]];
按照指南中操作后，transform中的查询会触发该错误，将字段名后追加.raw即可。该例中：filename =》 filename.raw
-
Likely root cause: expected '<document start>', but found BlockMappingStart
watcher的邮件配置请参照【https://www.elastic.co/guide/en/watcher/2.4/email-services.html】,追加到elasticsearch.yml文件后，watcher前必须加空格，否则启动elasticsearch将出错。
watcher.actions.email.service.account:
work:
profile: gmail
email_defaults:
from: 'John Doe <john.doe@host.domain>'
bcc: archive@host.domain
smtp:
auth: true
starttls.enable: true
host: smtp.gmail.com
port: 587
user: <username>
password: <password>
-
watcher相关的api
## 查看watcher列表
GET .watches/_search
{
"fields" : [],
"query" : {"match_all" : { } }
}
## 查看watcher
GET _watcher/watch/ftp_file_status
## 取消激活watcher
PUT _watcher/watch/ftp_file_status/_deactivate
## 删除watcher
DELETE _watcher/watch/ftp_status