http-post

// http.post: send a body. What a POST does on the target is the author's judgement: here, a search that
// only reads, the _count of an Elasticsearch or OpenSearch index.
need('protocol:http');

$url = variable('example:search:url', 'text', array(
    'label' => 'Address of the count',
    'help'  => 'For example https://search.example/logs-*/_count.',
));

output('errors', 'number', array('label' => 'Errors logged in the last 15 minutes'));

watch.above('error-burst', 'Burst of errors', 'errors', array('warning' => 10, 'critical' => 100));

// json.write builds the body from arrays: no quote to escape by hand.
$body = json.write(array('query' => array('bool' => array('filter' => array(
    array('term' => array('level' => 'error')),
    array('range' => array('@timestamp' => array('gte' => 'now-15m'))),
)))));
$answer = http.post($url, $body, headers=array('Content-Type' => 'application/json'));
if ($answer['status'] != 200) {
    fail('unreachable', 'The search answers ' . $answer['status'], $answer['body']);
}

// {"count": 42, ...}
$result = json.read($answer['body']);
value('errors', $result['count']);