Log created by custom watcher by "indexing action" , not visible in kibana observability log/stream

Question

I have made a custom watcher with indexing action. For this i created a index watcher-index using

PUT /watcher-index
{
  settings:{
    number_of_shards:3,
    number_of_replicas:1
  },
  "mappings":{
    "_default_":{
      "@timestamp":{
        "enabled":true,
        "store":true
      }
    }
  }
}

I mentioned in particular that @timestamp should be a default field. Now I mentioned the same in watcher definition -

{
  "actions":{
    "index":{
      "index":"watcher-index"
    }
  }
}

Action runs successfully and document is created as I can see by GET /watcher-index/_search. However, it does not display in kibana observability log/stream. A GET /watcher-index/_search{"query":{"match":{"field":"@timestamp"}}} returns 0 hits:[]. How can I solve this issue? I am using version-8.6.2.

Answer 1

Your query is looking for field name field and the value @timestamp.

Check with the following.

GET /watcher-index/_search
{
  "query": {
    "exists": {
      "field": "@timestamp"
    }
  }
}

If you want to see your data in the observability section the index name needs to start with the following parameters.

logs-*,filebeat-*,kibana_sample_data_logs*

You can update it with the observability settings.