Version: 7.x-36.0.0

This is a technical preview. Technical preview features are not fully supported, may not be functionally complete, and are not suitable for deployment in production. We encourage you to try them out and provide your feedback, good and bad, on the Search Guard forum. This will help us improve and add any features you might be missing.


Each watch can have one or more inputs. Inputs can be freely defined anywhere in the execution chain.

Each input will fetch data from a data source, and place it in the runtime data context under a configurable key for later usage.

At the moment, Signals supports the following input types:

  • Constants
    • Define constants you can then use at multiple places in the execution chain
  • Elasticsearch
    • Use the full power of Elasticsearch queries and aggregations
  • HTTP
    • Pull in data from a REST endpoint

All data from all inputs can be combined by using Transformation and Calculations, used in Conditions and pushed to action endpoints.

Not what you were looking for? Try the search.