Skip to main content
This is a pre-production deployment of Warehouse. Changes made here affect the production instance of PyPI (
Help us improve Python packaging - Donate today!

Python client for Elasticsearch Watcher

Project Description

This is an addon to the official elasticsearch python client that adds functionality for the Watcher plugin.


You can install this addon using pip:

pip install elasticsearch-watcher


You can use this client alone:

from elasticsearch import Elasticsearch
from elasticsearch_watcher import WatcherClient

client = Elasticsearch()
watcher = WatcherClient(client)


Or you can add the watcher namespace to the official client to mimic the behaviors of other namespaces:



Complex example

from time import sleep
from datetime import datetime
from random import randint

from elasticsearch import Elasticsearch
from elasticsearch_watcher import WatcherClient

# initialize the standard client as usual
es = Elasticsearch()
# add the .watcher namespace to it

# clear the index fiorst
    index=['alerts', 'test', '.watches', '.watch_history*'], ignore=404)

# get the watcher plugin version
print('Using watcher',['version']['number'])

# Register a new watch
        # label the watch
        'metadata': {'tags': ['errors']},

        # Run the watch every 10 seconds
        'trigger': { 'schedule': { 'interval': '10s' } },

        # Search for at least 3 documents matching the condition
        'condition': {  'script': { 'inline': ' > 3' } },

        # Throttle the watch execution for 30 seconds
        'throttle_period': '30s',

        # The search request to execute
        'input':   {
            'search': {
                'request': {
                    'indices': ['test'],
                    'body': {
                        'query': {
                            'filtered': {
                                'query': { 'match': { 'status': 500 } },
                                'filter': { 'range': { 'timestamp': { 'from': '{{ctx.trigger.scheduled_time}}||-5m', 'to': '{{ctx.trigger.triggered_time}}' } } }
                        # Return statistics about different hosts
                        'aggregations': {
                            'hosts': { 'terms': { 'field': 'host' } }

        # The actions to perform
        'actions': {
            'send_email':    {
                'transform': {
                    # Transform the data for the template
                    'script': '''return [
                            hosts: ctx.payload.aggregations.hosts.buckets.collect { [ host: it.key, errors: it.doc_count ] },
                            errors: ctx.payload.hits.hits.collect { it._source }
                'email': {
                    'to': '',
                    'subject': '[ALERT] {{ctx.watch_id}}',
                    'attach_data': True,
                    'body':  '''
                        Received {{}} error documents in the last 5 minutes.


                        {{#ctx.payload.hosts}}* {{host}} ({{errors}})
                        {{/ctx.payload.hosts}}'''.replace('\n'+' '*24, '\n').strip(),
            'index_payload': {
                # Transform the data to be stored
                'transform': { 'script': 'return [ watch_id: ctx.watch_id, payload: ctx.payload ]' },
                'index': { 'index': 'alerts', 'doc_type': 'alert' }
            'ping_webhook': {
                'webhook': {
                    'method': 'POST',
                    'host': 'localhost',
                    'port': 8000,
                    'path': '/',
                    'body': '{"watch_id" : "{{ctx.watch_id}}", "payload" : "{{ctx.payload}}"}'

# index documents to trigger the watch
for _ in range(5):
            'timestamp': datetime.utcnow(),
            'status': 500,
            'host': '10.0.0.%d' % randint(1, 3)

# wait a bit...
for _ in range(30):
    print('.', sep='', end='', flush=True)

# display information about watch execution
print('=' * 80)
s =
for hit in s['hits']['hits']:
    print('%s: %s' % (hit['_id'], hit['_source']['state']))

# delete the watch
es.watcher.delete_watch(id='error_500', force=True)


Copyright 2015 Elasticsearch

Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License. You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Release History

Release History

This version
History Node


Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
elasticsearch_watcher-0.4.0-py2.py3-none-any.whl (7.7 kB) Copy SHA256 Checksum SHA256 3.3 Wheel May 18, 2015
elasticsearch-watcher-0.4.0.tar.gz (4.8 kB) Copy SHA256 Checksum SHA256 Source May 18, 2015

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting