checked. (hourly, daily, weekly, monthly, yearly, cron or interval) input Loads data into the watch payload. What alert on. Typically an Elasticsearch query. (simple, search, http, chain) condition Decides whether to take actions. (always, never, compare, array_compare, script) transform Processes the watch payload. Both the watch level and the action level are available. actions Specifies actions to take when the condition is met. (email, webhook, index, logging and etc.) metadata Defines optional static metadata. PUT _xpack/watcher/watch/my-watch { "trigger": {…}, "input": {…}, "condition": {…}, "transform": {…}, "actions": {…} "metadata": {…} }