It works against elasticsearch and is somewhat agnostic as to how those documents got there in the first place. I've been playing with it as part of an EFK (fluentd instead of logstash) install.

Do you have a link to the logstash alerting plugin? I'm not familiar with it and I'm interested in alert tools for the elk (and beats) stack.

Are you referring to watcher? That's a paid product I believe no?