Elastic Stack

Elastic Stack (ELK Stack) Watcher API

The watcher API from Elastic Stack (ELK Stack) — 13 operation(s) for watcher.

GitHub OpenAPI

Operations 24

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

PUT /_watcher/watch/{watch_id}/_ack Acknowledge all actions of a watch (PUT) · Acknowledge a watch #
Ask an LLM
“How do I acknowledge a watch with a PUT request so its actions stop firing?”
“Can I throttle every action of a noisy watch by acknowledging it via PUT?”
Tell an agent
Acknowledge all actions of watch {watch_id} using PUT.
Send a PUT acknowledgement for every action on watch {watch_id}.
POST /_watcher/watch/{watch_id}/_ack Acknowledge all actions of a watch (POST) · Acknowledge a watch #
Ask an LLM
“How do I acknowledge an entire watch using a POST request?”
“Can I silence all actions of a watch with the POST form of the ack call?”
Tell an agent
Acknowledge all actions of watch {watch_id} using POST.
Send a POST acknowledgement for every action on watch {watch_id}.
PUT /_watcher/watch/{watch_id}/_ack/{action_id} Acknowledge one action of a watch (PUT) · Acknowledge a watch #
Ask an LLM
“Can I acknowledge just one action of a watch with a PUT request?”
“How do I throttle a single watch action via PUT while others keep running?”
Tell an agent
Acknowledge action {action_id} of watch {watch_id} using PUT.
Send a PUT ack for only action {action_id} on watch {watch_id}.
POST /_watcher/watch/{watch_id}/_ack/{action_id} Acknowledge one action of a watch (POST) · Acknowledge a watch #
Ask an LLM
“How do I acknowledge a single named action of a watch using POST?”
“Can I throttle one specific action through the POST ack endpoint?”
Tell an agent
Acknowledge action {action_id} of watch {watch_id} using POST.
Send a POST ack for only action {action_id} on watch {watch_id}.
PUT /_watcher/watch/{watch_id}/_activate Activate a watch (PUT) · Activate a watch #
Ask an LLM
“How do I turn an inactive watch back on with a PUT request?”
“Can I re-enable a paused watch using PUT?”
Tell an agent
Activate watch {watch_id} using PUT.
Re-enable the inactive watch {watch_id} with a PUT request.
POST /_watcher/watch/{watch_id}/_activate Activate a watch (POST) · Activate a watch #
Ask an LLM
“How do I activate a watch with a POST request?”
“Can I switch a watch to active using the POST form?”
Tell an agent
Activate watch {watch_id} using POST.
Re-enable the inactive watch {watch_id} with a POST request.
PUT /_watcher/watch/{watch_id}/_deactivate Deactivate a watch (PUT) · Deactivate a watch #
Ask an LLM
“How do I pause a watch with a PUT request without deleting it?”
“Can I make a watch inactive using PUT?”
Tell an agent
Deactivate watch {watch_id} using PUT.
Pause watch {watch_id} with a PUT request so it stops triggering.
POST /_watcher/watch/{watch_id}/_deactivate Deactivate a watch (POST) · Deactivate a watch #
Ask an LLM
“How do I deactivate a watch with a POST request?”
“Can I stop a watch from triggering via the POST deactivate call?”
Tell an agent
Deactivate watch {watch_id} using POST.
Pause watch {watch_id} with a POST request so it stops triggering.
GET /_watcher/watch/{id} Get a watch definition · Get a watch #
Ask an LLM
“What does a specific watch's trigger, condition and actions look like?”
“Can I fetch one watch and its status by id?”
Tell an agent
Get watch {id}.
Show the definition and status of watch {id}.
PUT /_watcher/watch/{id} Create or update a watch (PUT) · Create or update a watch #
Ask an LLM
“How do I register a new alerting watch with a PUT request?”
“Can I create a watch in an inactive state using PUT?”
Tell an agent
Create watch {id} with trigger {trigger}, input {input}, condition {condition} and actions {actions} using PUT.
PUT watch {id} as inactive by setting active to {active}.
POST /_watcher/watch/{id} Create or update a watch (POST) · Create or update a watch #
Ask an LLM
“How do I register or overwrite a watch with a POST request?”
“Can I set a throttle period when saving a watch through POST?”
Tell an agent
Create watch {id} with trigger {trigger}, condition {condition} and actions {actions} using POST.
POST watch {id} with a throttle period of {throttle_period}.
DELETE /_watcher/watch/{id} Delete a watch · Delete a watch #
Ask an LLM
“How do I permanently remove a watch so it never runs again?”
“Does deleting a watch also delete its execution history?”
Tell an agent destructive · confirm first
Delete watch {id}.
Remove watch {id} from Watcher permanently.
PUT /_watcher/watch/{id}/_execute Run a stored watch now (PUT) · Run a watch #
Ask an LLM
“How do I force a stored watch to run immediately with a PUT request?”
“Can I simulate a saved watch's actions via PUT without actually sending them?”
Tell an agent
Execute stored watch {id} now using PUT.
Run watch {id} via PUT ignoring its condition when ignore_condition is {ignore_condition}.
POST /_watcher/watch/{id}/_execute Run a stored watch now (POST) · Run a watch #
Ask an LLM
“How do I trigger a saved watch on demand with a POST request?”
“Can I feed alternative input to a stored watch when running it via POST?”
Tell an agent
Execute stored watch {id} now using POST.
Run watch {id} via POST with alternative input {alternative_input}.
PUT /_watcher/watch/_execute Test an inline watch definition (PUT) · Run a watch #
Ask an LLM
“Can I try out a watch definition with PUT before saving it?”
“How do I run an unsaved, inline watch using a PUT request?”
Tell an agent
Run the inline watch {watch} using PUT without storing it.
Test watch definition {watch} via PUT with debug output {debug}.
POST /_watcher/watch/_execute Test an inline watch definition (POST) · Run a watch #
Ask an LLM
“How do I execute an ad-hoc watch body with a POST request?”
“Can I dry-run an unsaved watch using the POST execute endpoint?”
Tell an agent
Run the inline watch {watch} using POST without storing it.
Dry-run watch definition {watch} via POST with action modes {action_modes}.
GET /_watcher/settings Get Watcher index settings · Get Watcher index settings #
Ask an LLM
“How many replicas does the .watches index currently use?”
“What settings can I see on the internal Watcher index?”
Tell an agent
Show the Watcher index settings.
Get the .watches index settings, waiting up to {master_timeout} for the master node.
PUT /_watcher/settings Update Watcher index settings · Update Watcher index settings #
Ask an LLM
“How do I change the replica count of the .watches index?”
“Can I set auto-expand replicas on the Watcher index?”
Tell an agent
Set the Watcher index number of replicas to {number_of_replicas}.
Set auto_expand_replicas on the .watches index to {auto_expand_replicas}.
GET /_watcher/_query/watches Search registered watches (GET) · Query watches #
Ask an LLM
“How do I list all watches page by page with a GET request?”
“Can I filter watches by metadata fields when querying with GET?”
Tell an agent
List registered watches with GET, returning {size} at a time.
Query watches via GET matching {query}.
POST /_watcher/_query/watches Search registered watches (POST) · Query watches #
Ask an LLM
“How do I query watches with a POST body and sort the results?”
“Can I page past the first results using search_after when querying watches via POST?”
Tell an agent
Query watches via POST matching {query}, sorted by {sort}.
Get the next page of watches via POST after {search_after}.
POST /_watcher/_start Start the Watcher service · Start the watch service #
Ask an LLM
“How do I start Watcher if it isn't running?”
“Can I turn the watch service back on for the cluster?”
Tell an agent
Start the Watcher service.
Start Watcher, waiting up to {master_timeout} for the master node.
GET /_watcher/stats Get Watcher statistics · Get Watcher statistics #
Ask an LLM
“Is Watcher running and how many watches are executing?”
“Can I include stack traces for executing watches in Watcher stats?”
Tell an agent
Show Watcher statistics.
Get Watcher stats with stack traces when emit_stacktraces is {emit_stacktraces}.
GET /_watcher/stats/{metric} Get a specific Watcher statistics metric · Get Watcher statistics #
Ask an LLM
“How do I see only the current watches or queued watches metric?”
“Can I ask Watcher for a single named statistics metric?”
Tell an agent
Get the Watcher stats metric {metric}.
Show only the {metric} Watcher metric.
POST /_watcher/_stop Stop the Watcher service · Stop the watch service #
Ask an LLM
“How do I stop Watcher from running any watches?”
“Can I shut down the watch service during maintenance?”
Tell an agent
Stop the Watcher service.
Stop Watcher, waiting up to {master_timeout} for the master node.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-watcher-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-watcher-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-watcher-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Elasticsearch Request & Response Specification Watcher API
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
tags:


# --- truncated at 32 KB (571 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-watcher-api-openapi.yml