Elastic Watch for Heartbeat

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": [
          "heartbeat-*"
        ],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-1m"
                    }
                  }
                }
              ],
              "must": [
                {
                  "term": {
                    "up": false
                  }
                }
              ]
            }
          },
          "aggregations": {
            "by_monitors": {
              "terms": {
                "field": "monitor"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "inline": "ctx.payload.aggregations.by_monitors.buckets.size() > 0",
      "lang": "painless"
    }
  },
  "actions": {
    "log_error": {
      "transform": {
        "script": {
          "inline": "def alerts = ctx.payload.aggregations.by_monitors.buckets.stream().map(b->b.key).collect(Collectors.toList()); return [\"alerts\":alerts];",
          "lang": "painless"
        }
      },
      "logging": {
        "text": "The following hosts are down:\n          \n{{#ctx.payload.alerts}}\n    {{.}}\n{{/ctx.payload.alerts}}"
      }
    },
    "notify-slack": {
      "throttle_period": "15m",
      "slack": {
        "account": "monitoring",
        "message": {
          "from": "Heartbeat",
          "text": "Some hosts are unresponsive.",
          "dynamic_attachments": {
            "list_path": "ctx.payload.aggregations.by_monitors.buckets",
            "attachment_template": {
              "title": "{{key}}",
              "text": "Total events: {{doc_count}}",
              "color": "warning"
            }
          }
        }
      }
    }
  }
}