watch.json

{
  "metadata": {
    "bucket_interval": "5m",
    "time_period": "8h",
    "query_string": "elasticsearch"
  },
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": "twitter*",
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "text: {{ctx.metadata.query_string}}",
                    "analyze_wildcard": true
                  }
                }
              ],
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-{{ctx.metadata.time_period}}",
                    "format": "epoch_millis"
                  }
                }
              }
            }
          },
          "size": 0,
          "aggs": {
            "date_buckets": {
              "date_histogram": {
                "field": "@timestamp",
                "fixed_interval": "{{ctx.metadata.bucket_interval}}",
                "min_doc_count": 0
              }
            },
            "percentiles": {
              "percentiles_bucket": {
                "buckets_path": "date_buckets._count",
                "percents": [
                  90.0
                ]
              }
            },
            "stats": {
              "extended_stats_bucket": {
                "buckets_path": "date_buckets._count"
              }
            }
          }
        }
      }
    }
  },
  "throttle_period": "15m",
  "condition": {
    "script": {
      "id": "condition"
    }
  },
  "actions": {
    "log": {
      "logging": {
        "text": "{{ctx.metadata.query_string}} is getting attention!"
      }
    }
  }
}