message: rework of the watcher for some 'real lagoon' differences from local
diff: {
  - "trigger" : { "schedule" : { "interval" : "30s" }},
  + "trigger": {
  + "schedule": {
  + "interval": "30s"
  + }
  + },
  "input": {
  "search": {
  "request": {
  - "indices" : [ "service-logs-*" ],
  + "search_type": "query_then_fetch",
  + "indices": [
  + "service-logs-*"
  + ],
  + "types": [],
  "body": {
  "query": {
  "bool": {
  }
  },
  "must": [
  - { "term" : { "action" : "disconnected" }},
  - { "term" : { "reason.err.cause.host":"rabbitmq"}}
  + {
  + "match": {
  + "action": "disconnected"
  + }
  + }
  + ],
  + "should": [
  + {
  + "regexp": {
  + "message": "^lagoon-.*: Not connected"
  + }
  + }
  ]
  }
  },
  "group_by_service": {
  "terms": {
  "field": "label.keyword",
  - "size": 5
  + "size": 25
  }
  }
  }
  }
  },
  "condition": {
  - "compare" : { "ctx.payload.hits.total" : { "gt" : 2 }}
  + "compare": {
  + "ctx.payload.hits.total": {
  + "gt": 2
  + }
  + }
  },
  "actions": {
  "notify-slack": {
  "account": "monitoring",
  "message": {
  "from": "lagoon-xpack",
  - "to" : [ "#lagoon-dev-alerts" ],
  - "text" : "RabbitMQ connection errors from Lagoon services"
  + "to": [
  + "#lagoon-dev-alerts"
  + ],
  + "text": "Connection errors from {{#ctx.payload.aggregations.group_by_service.buckets}}{{key}} {{/ctx.payload.aggregations.group_by_service.buckets}}"
  }
  }
  }
  