Elastic Stack (ELK Stack) Watcher API

openapi: 3.2.0
info:
  title: Elasticsearch Request & Response Specification Watcher API
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
tags:
- name: watcher
paths:
  /_watcher/watch/{watch_id}/_ack:
    put:
      tags:
      - watcher
      summary: Acknowledge a watch
      description: 'Acknowledging a watch enables you to manually throttle the execution of the watch''s actions.


        The acknowledgement state of an action is stored in the `status.actions.<id>.ack.state` structure.


        IMPORTANT: If the specified watch is currently being executed, this API will return an error

        The reason for this behavior is to prevent overwriting the watch status from a watch execution.


        Acknowledging an action throttles further executions of that action until its `ack.state` is reset to `awaits_successful_execution`.

        This happens when the condition of the watch is not met (the condition evaluates to false).

        To demonstrate how throttling works in practice and how it can be configured for individual actions within a watch, refer to External documentation.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: Learn more about actions
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/actions#example
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-ack-watch.html
      operationId: watcher-ack-watch
      parameters:
      - $ref: '#/components/parameters/watcher.ack_watch-watch_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.ack_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Acknowledge a watch
      description: 'Acknowledging a watch enables you to manually throttle the execution of the watch''s actions.


        The acknowledgement state of an action is stored in the `status.actions.<id>.ack.state` structure.


        IMPORTANT: If the specified watch is currently being executed, this API will return an error

        The reason for this behavior is to prevent overwriting the watch status from a watch execution.


        Acknowledging an action throttles further executions of that action until its `ack.state` is reset to `awaits_successful_execution`.

        This happens when the condition of the watch is not met (the condition evaluates to false).

        To demonstrate how throttling works in practice and how it can be configured for individual actions within a watch, refer to External documentation.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: Learn more about actions
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/actions#example
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-ack-watch.html
      operationId: watcher-ack-watch-1
      parameters:
      - $ref: '#/components/parameters/watcher.ack_watch-watch_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.ack_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/watch/{watch_id}/_ack/{action_id}:
    put:
      tags:
      - watcher
      summary: Acknowledge a watch
      description: 'Acknowledging a watch enables you to manually throttle the execution of the watch''s actions.


        The acknowledgement state of an action is stored in the `status.actions.<id>.ack.state` structure.


        IMPORTANT: If the specified watch is currently being executed, this API will return an error

        The reason for this behavior is to prevent overwriting the watch status from a watch execution.


        Acknowledging an action throttles further executions of that action until its `ack.state` is reset to `awaits_successful_execution`.

        This happens when the condition of the watch is not met (the condition evaluates to false).

        To demonstrate how throttling works in practice and how it can be configured for individual actions within a watch, refer to External documentation.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: Learn more about actions
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/actions#example
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-ack-watch.html
      operationId: watcher-ack-watch-2
      parameters:
      - $ref: '#/components/parameters/watcher.ack_watch-watch_id'
      - $ref: '#/components/parameters/watcher.ack_watch-action_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.ack_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Acknowledge a watch
      description: 'Acknowledging a watch enables you to manually throttle the execution of the watch''s actions.


        The acknowledgement state of an action is stored in the `status.actions.<id>.ack.state` structure.


        IMPORTANT: If the specified watch is currently being executed, this API will return an error

        The reason for this behavior is to prevent overwriting the watch status from a watch execution.


        Acknowledging an action throttles further executions of that action until its `ack.state` is reset to `awaits_successful_execution`.

        This happens when the condition of the watch is not met (the condition evaluates to false).

        To demonstrate how throttling works in practice and how it can be configured for individual actions within a watch, refer to External documentation.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: Learn more about actions
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/actions#example
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-ack-watch.html
      operationId: watcher-ack-watch-3
      parameters:
      - $ref: '#/components/parameters/watcher.ack_watch-watch_id'
      - $ref: '#/components/parameters/watcher.ack_watch-action_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.ack_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/watch/{watch_id}/_activate:
    put:
      tags:
      - watcher
      summary: Activate a watch
      description: 'A watch can be either active or inactive.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about how Watcher works
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/how-watcher-works
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-activate-watch.html
      operationId: watcher-activate-watch
      parameters:
      - $ref: '#/components/parameters/watcher.activate_watch-watch_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.activate_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Activate a watch
      description: 'A watch can be either active or inactive.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about how Watcher works
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/how-watcher-works
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-activate-watch.html
      operationId: watcher-activate-watch-1
      parameters:
      - $ref: '#/components/parameters/watcher.activate_watch-watch_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.activate_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/watch/{watch_id}/_deactivate:
    put:
      tags:
      - watcher
      summary: Deactivate a watch
      description: 'A watch can be either active or inactive.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about how Watcher works
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/how-watcher-works
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-deactivate-watch.html
      operationId: watcher-deactivate-watch
      parameters:
      - $ref: '#/components/parameters/watcher.deactivate_watch-watch_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.deactivate_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Deactivate a watch
      description: 'A watch can be either active or inactive.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about how Watcher works
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/how-watcher-works
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-deactivate-watch.html
      operationId: watcher-deactivate-watch-1
      parameters:
      - $ref: '#/components/parameters/watcher.deactivate_watch-watch_id'
      responses:
        '200':
          $ref: '#/components/responses/watcher.deactivate_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/watch/{id}:
    get:
      tags:
      - watcher
      summary: Get a watch
      description: '


        ## Required authorization


        * Cluster privileges: `monitor_watcher`

        '
      operationId: watcher-get-watch
      parameters:
      - in: path
        name: id
        description: The watch identifier.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  found:
                    type: boolean
                  _id:
                    allOf:
                    - $ref: '#/components/schemas/_types.Id'
                  status:
                    allOf:
                    - $ref: '#/components/schemas/watcher._types.WatchStatus'
                  watch:
                    allOf:
                    - $ref: '#/components/schemas/watcher._types.Watch'
                  _primary_term:
                    type: number
                  _seq_no:
                    allOf:
                    - $ref: '#/components/schemas/_types.SequenceNumber'
                  _version:
                    allOf:
                    - $ref: '#/components/schemas/_types.VersionNumber'
                required:
                - found
                - _id
              examples:
                GetWatchResponseExample1:
                  description: A successful response from `GET _watcher/watch/my_watch`.
                  value: "{\n  \"found\": true,\n  \"_id\": \"my_watch\",\n  \"_seq_no\": 0,\n  \"_primary_term\": 1,\n  \"_version\": 1,\n  \"status\": { \n    \"version\": 1,\n    \"state\": {\n      \"active\": true,\n      \"timestamp\": \"2015-05-26T18:21:08.630Z\"\n    },\n    \"actions\": {\n      \"test_index\": {\n        \"ack\": {\n          \"timestamp\": \"2015-05-26T18:21:08.630Z\",\n          \"state\": \"awaits_successful_execution\"\n        }\n      }\n    }\n  },\n  \"watch\": {\n    \"input\": {\n      \"simple\": {\n        \"payload\": {\n          \"send\": \"yes\"\n        }\n      }\n    },\n    \"condition\": {\n      \"always\": {}\n    },\n    \"trigger\": {\n      \"schedule\": {\n        \"hourly\": {\n          \"minute\": [0, 5]\n        }\n      }\n    },\n    \"actions\": {\n      \"test_index\": {\n        \"index\": {\n          \"index\": \"test\"\n        }\n      }\n    }\n  }\n}"
      x-state: Generally available; Added in 5.6.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    put:
      tags:
      - watcher
      summary: Create or update a watch
      description: 'When a watch is registered, a new document that represents the watch is added to the `.watches` index and its trigger is immediately registered with the relevant trigger engine.

        Typically for the `schedule` trigger, the scheduler is the trigger engine.


        IMPORTANT: You must use Kibana or this API to create a watch.

        Do not add a watch directly to the `.watches` index by using the Elasticsearch index API.

        If Elasticsearch security features are enabled, do not give users write privileges on the `.watches` index.


        When you add a watch you can also define its initial active state by setting the *active* parameter.


        When Elasticsearch security features are enabled, your watch can index or search only on indices for which the user that stored the watch has privileges.

        If the user is able to read index `a`, but not index `b`, the same will apply when the watch runs.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      operationId: watcher-put-watch
      parameters:
      - $ref: '#/components/parameters/watcher.put_watch-id'
      - $ref: '#/components/parameters/watcher.put_watch-active'
      - $ref: '#/components/parameters/watcher.put_watch-if_primary_term'
      - $ref: '#/components/parameters/watcher.put_watch-if_seq_no'
      - $ref: '#/components/parameters/watcher.put_watch-version'
      requestBody:
        $ref: '#/components/requestBodies/watcher.put_watch'
      responses:
        '200':
          $ref: '#/components/responses/watcher.put_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Create or update a watch
      description: 'When a watch is registered, a new document that represents the watch is added to the `.watches` index and its trigger is immediately registered with the relevant trigger engine.

        Typically for the `schedule` trigger, the scheduler is the trigger engine.


        IMPORTANT: You must use Kibana or this API to create a watch.

        Do not add a watch directly to the `.watches` index by using the Elasticsearch index API.

        If Elasticsearch security features are enabled, do not give users write privileges on the `.watches` index.


        When you add a watch you can also define its initial active state by setting the *active* parameter.


        When Elasticsearch security features are enabled, your watch can index or search only on indices for which the user that stored the watch has privileges.

        If the user is able to read index `a`, but not index `b`, the same will apply when the watch runs.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      operationId: watcher-put-watch-1
      parameters:
      - $ref: '#/components/parameters/watcher.put_watch-id'
      - $ref: '#/components/parameters/watcher.put_watch-active'
      - $ref: '#/components/parameters/watcher.put_watch-if_primary_term'
      - $ref: '#/components/parameters/watcher.put_watch-if_seq_no'
      - $ref: '#/components/parameters/watcher.put_watch-version'
      requestBody:
        $ref: '#/components/requestBodies/watcher.put_watch'
      responses:
        '200':
          $ref: '#/components/responses/watcher.put_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - watcher
      summary: Delete a watch
      description: 'When the watch is removed, the document representing the watch in the `.watches` index is gone and it will never be run again.


        Deleting a watch does not delete any watch execution records related to this watch from the watch history.


        IMPORTANT: Deleting a watch must be done by using only this API.

        Do not delete the watch directly from the `.watches` index using the Elasticsearch delete document API

        When Elasticsearch security features are enabled, make sure no write privileges are granted to anyone for the `.watches` index.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      operationId: watcher-delete-watch
      parameters:
      - in: path
        name: id
        description: The watch identifier.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  found:
                    type: boolean
                  _id:
                    allOf:
                    - $ref: '#/components/schemas/_types.Id'
                  _version:
                    allOf:
                    - $ref: '#/components/schemas/_types.VersionNumber'
                required:
                - found
                - _id
                - _version
              examples:
                DeleteWatchResponseExample1:
                  description: A successful response from `DELETE _watcher/watch/my_watch`.
                  value: "{\n  \"found\": true,\n  \"_id\": \"my_watch\",\n  \"_version\": 2\n}"
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/watch/{id}/_execute:
    put:
      tags:
      - watcher
      summary: Run a watch
      description: 'This API can be used to force execution of the watch outside of its triggering logic or to simulate the watch execution for debugging purposes.


        For testing and debugging purposes, you also have fine-grained control on how the watch runs.

        You can run the watch without running all of its actions or alternatively by simulating them.

        You can also force execution by ignoring the watch condition and control whether a watch record would be written to the watch history after it runs.


        You can use the run watch API to run watches that are not yet registered by specifying the watch definition inline.

        This serves as great tool for testing and debugging your watches prior to adding them to Watcher.


        When Elasticsearch security features are enabled on your cluster, watches are run with the privileges of the user that stored the watches.

        If your user is allowed to read index `a`, but not index `b`, then the exact same set of rules will apply during execution of a watch.


        When using the run watch API, the authorization data of the user that called the API will be used as a base, instead of the information who stored the watch.

        Refer to the external documentation for examples of watch execution requests, including existing, customized, and inline watches.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about executing a watch
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/execute-watch
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-execute-watch.html
      operationId: watcher-execute-watch
      parameters:
      - $ref: '#/components/parameters/watcher.execute_watch-id'
      - $ref: '#/components/parameters/watcher.execute_watch-debug'
      requestBody:
        $ref: '#/components/requestBodies/watcher.execute_watch'
      responses:
        '200':
          $ref: '#/components/responses/watcher.execute_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Run a watch
      description: 'This API can be used to force execution of the watch outside of its triggering logic or to simulate the watch execution for debugging purposes.


        For testing and debugging purposes, you also have fine-grained control on how the watch runs.

        You can run the watch without running all of its actions or alternatively by simulating them.

        You can also force execution by ignoring the watch condition and control whether a watch record would be written to the watch history after it runs.


        You can use the run watch API to run watches that are not yet registered by specifying the watch definition inline.

        This serves as great tool for testing and debugging your watches prior to adding them to Watcher.


        When Elasticsearch security features are enabled on your cluster, watches are run with the privileges of the user that stored the watches.

        If your user is allowed to read index `a`, but not index `b`, then the exact same set of rules will apply during execution of a watch.


        When using the run watch API, the authorization data of the user that called the API will be used as a base, instead of the information who stored the watch.

        Refer to the external documentation for examples of watch execution requests, including existing, customized, and inline watches.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about executing a watch
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/execute-watch
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-execute-watch.html
      operationId: watcher-execute-watch-1
      parameters:
      - $ref: '#/components/parameters/watcher.execute_watch-id'
      - $ref: '#/components/parameters/watcher.execute_watch-debug'
      requestBody:
        $ref: '#/components/requestBodies/watcher.execute_watch'
      responses:
        '200':
          $ref: '#/components/responses/watcher.execute_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/watch/_execute:
    put:
      tags:
      - watcher
      summary: Run a watch
      description: 'This API can be used to force execution of the watch outside of its triggering logic or to simulate the watch execution for debugging purposes.


        For testing and debugging purposes, you also have fine-grained control on how the watch runs.

        You can run the watch without running all of its actions or alternatively by simulating them.

        You can also force execution by ignoring the watch condition and control whether a watch record would be written to the watch history after it runs.


        You can use the run watch API to run watches that are not yet registered by specifying the watch definition inline.

        This serves as great tool for testing and debugging your watches prior to adding them to Watcher.


        When Elasticsearch security features are enabled on your cluster, watches are run with the privileges of the user that stored the watches.

        If your user is allowed to read index `a`, but not index `b`, then the exact same set of rules will apply during execution of a watch.


        When using the run watch API, the authorization data of the user that called the API will be used as a base, instead of the information who stored the watch.

        Refer to the external documentation for examples of watch execution requests, including existing, customized, and inline watches.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about executing a watch
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/execute-watch
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-execute-watch.html
      operationId: watcher-execute-watch-2
      parameters:
      - $ref: '#/components/parameters/watcher.execute_watch-debug'
      requestBody:
        $ref: '#/components/requestBodies/watcher.execute_watch'
      responses:
        '200':
          $ref: '#/components/responses/watcher.execute_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Run a watch
      description: 'This API can be used to force execution of the watch outside of its triggering logic or to simulate the watch execution for debugging purposes.


        For testing and debugging purposes, you also have fine-grained control on how the watch runs.

        You can run the watch without running all of its actions or alternatively by simulating them.

        You can also force execution by ignoring the watch condition and control whether a watch record would be written to the watch history after it runs.


        You can use the run watch API to run watches that are not yet registered by specifying the watch definition inline.

        This serves as great tool for testing and debugging your watches prior to adding them to Watcher.


        When Elasticsearch security features are enabled on your cluster, watches are run with the privileges of the user that stored the watches.

        If your user is allowed to read index `a`, but not index `b`, then the exact same set of rules will apply during execution of a watch.


        When using the run watch API, the authorization data of the user that called the API will be used as a base, instead of the information who stored the watch.

        Refer to the external documentation for examples of watch execution requests, including existing, customized, and inline watches.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      externalDocs:
        description: More about executing a watch
        url: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/execute-watch
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/watcher-api-execute-watch.html
      operationId: watcher-execute-watch-3
      parameters:
      - $ref: '#/components/parameters/watcher.execute_watch-debug'
      requestBody:
        $ref: '#/components/requestBodies/watcher.execute_watch'
      responses:
        '200':
          $ref: '#/components/responses/watcher.execute_watch-200'
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/settings:
    get:
      tags:
      - watcher
      summary: Get Watcher index settings
      description: 'Get settings for the Watcher internal index (`.watches`).

        Only a subset of settings are shown, for example `index.auto_expand_replicas` and `index.number_of_replicas`.'
      operationId: watcher-get-settings
      parameters:
      - in: query
        name: master_timeout
        description: 'The period to wait for a connection to the master node.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  index:
                    allOf:
                    - $ref: '#/components/schemas/indices._types.IndexSettings'
                required:
                - index
              examples:
                WatcherGetSettingsResponseExample1:
                  description: A successful response with two index settings.
                  value: "{\n  \"index\": {\n    \"auto_expand_replicas\": \"0-4\",\n    \"number_of_replicas\": 0\n  }\n}"
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    put:
      tags:
      - watcher
      summary: Update Watcher index settings
      description: 'Update settings for the Watcher internal index (`.watches`).

        Only a subset of settings can be modified.

        This includes `index.auto_expand_replicas`, `index.number_of_replicas`, `index.routing.allocation.exclude.*`,

        `index.routing.allocation.include.*` and `index.routing.allocation.require.*`.

        Modification of `index.routing.allocation.include._tier_preference` is an exception and is not allowed as the

        Watcher shards must always be in the `data_content` tier.


        ## Required authorization


        * Cluster privileges: `manage_watcher`

        '
      operationId: watcher-update-settings
      parameters:
      - in: query
        name: master_timeout
        description: 'The period to wait for a connection to the master node.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: 'The period to wait for a response.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Duration'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                index.auto_expand_replicas:
                  type: string
                index.number_of_replicas:
                  type: number
            examples:
              WatcherUpdateSettingsRequestExample1:
                value: "{\n  \"index.auto_expand_replicas\": \"0-4\"\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                - acknowledged
      x-state: Generally available
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_watcher/_query/watches:
    get:
      tags:
      - watcher
      summary: Query watches
      description: 'Get all registered watches in a paginated manner and optionally filter watches by a query.


        Note that only the `_id` and `metadata.*` fields are queryable or sortable.


        ## Required authorization


        * Cluster privileges: `monitor_watcher`

        '
      operationId: watcher-query-watches
      requestBody:
        $ref: '#/components/requestBodies/watcher.query_watches'
      responses:
        '200':
          $ref: '#/components/responses/watcher.query_watches-200'
      x-state: Generally available; Added in 7.11.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - watcher
      summary: Query watches
      description: 'Get all registered watches in a paginated manner and optionally filter watches by a query.


        Note that only the `_id` and `metadata.*` fields are queryable or sortable.


        ## Required authorization


        * Cluster privileges: `monitor_wa

# --- truncated at 32 KB (571 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-watcher-api-openapi.yml