Accessing Bucket aggregation in watcher condition. unexpected token was expecting one of [{<EOF>, ';'}]

I am executing the below watch and want to compare the values of bucket 1D from the aggregation in the watcher condition. However, I am getting errors while accessing the value.

POST _watcher/watch/_execute
{
  "watch":
  {
  "trigger": {
    "schedule": {
      "interval": "1d"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "index"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "rtd.TIME": {
                      "gte": "now-9d",
                      "lte": "now"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "DATE_RANGE": {
              "date_range": {
                "field": "rtd.XCN_DATE_TIME",
                "keyed": true,
                "ranges": [
                  {
                    "key": "1D",
                    "from": "2023-04-26T18:09:27.510Z",
                    "to": "2023-04-26T19:09:27.510Z"
                  },
                  {
                    "key": "8D",
                    "from": "2023-04-26T20:09:27.510Z",
                    "to": "2023-04-26T21:09:27.510Z"
                  }
                ]
              },
              "aggs": {
                "FDZ_MODEL": {
                  "nested": {
                    "path": "score.fdz.models"
                  },
                  "aggs": {
                    "FDZ_MODEL_TYPE": {
                      "filter": {
                        "term": {
                          "score.fdz.models.modelName": "EMD_TMX_BROWSER"
                        }
                      },
                      "aggs": {
                        "STATS": {
                          "extended_stats": {
                            "field": "score.fdz.models.score"
                          }
                        }
                      }
                    }
                  }
                },
                "STATS_AVG": {
                  "bucket_script": {
                    "buckets_path": {
                      "AVG": "FDZ_MODEL>FDZ_MODEL_TYPE>STATS.avg"
                    },
                    "script": "params.AVG"
                  }
                },
                "STATS_STD": {
                  "bucket_script": {
                    "buckets_path": {
                      "STD": "FDZ_MODEL>FDZ_MODEL_TYPE>STATS.std_deviation"
                    },
                    "script": "params.STD*1"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      **"source": "ctx.payload.aggregations.DATE_RANGE.buckets.1D.doc_count > params.threshold"**,
      "lang": "painless",
      "params": {
        "threshold": 5
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "account": "exchange_account",
        "profile": "standard",
        "to": [
          "rahul.r.kothanath@gmail.com"
        ],
        "subject": "Kibana-Alert[Feed Score Variation]",
        "body": {
          "text": "flow having abnormal variations and please have a look"
        }
      }
    }
  }
}
}

I am trying to access the doc_count of bucket 1D but it is throwing below error.

 "script_stack" : [
      "... ions.DATE_RANGE.buckets.1D.doc_count > params.thre ...",
      "                             ^---- HERE"
    ],
    "script" : "ctx.payload.aggregations.DATE_RANGE.buckets.1D.doc_count > params.threshold",
    "lang" : "painless",
    "position" : {
      "offset" : 45,
      "start" : 20,
      "end" : 70
    },
    "caused_by" : {
      "type" : "illegal_argument_exception",
      "reason" : "unexpected token ['D'] was expecting one of [{<EOF>, ';'}]."
    }
  },

Below is the watcher result.

"payload" : {
          "_shards" : {
            "total" : 10,
            "failed" : 0,
            "successful" : 10,
            "skipped" : 0
          },
          "hits" : {
            "hits" : [ ],
            "total" : 10000,
            "max_score" : null
          },
          "took" : 4733,
          "timed_out" : false,
          "aggregations" : {
            "DATE_RANGE" : {
              "buckets" : {
                "1D" : {
                  "from_as_string" : "2023-04-26T18:09:27.510Z",
                  "doc_count" : 8384,
                  "FDZ_MODEL" : {
                    "doc_count" : 15898,
                    "FDZ_MODEL_TYPE" : {
                      "doc_count" : 6486,
                      "STATS" : {
                        "variance_population" : 6.528151949328301E-4,
                        "std_deviation_bounds" : {
                          "upper_population" : 0.05424420624422534,
                          "upper" : 0.05424420624422534,
                          "lower" : -0.04795678748345464,
                          "lower_population" : -0.04795678748345464,
                          "upper_sampling" : 0.05424814599187884,
                          "lower_sampling" : -0.04796072723110814
                        },
                        "max" : 0.9284928441047668,
                        "count" : 6486,
                        "sum" : 20.390099041179383,
                        "std_deviation_population" : 0.025550248431919994,
                        "sum_of_squares" : 4.2982598999570785,
                        "std_deviation_sampling" : 0.025552218305746745,
                        "min" : 4.836584594158921E-6,
                        "avg" : 0.0031437093803853506,
                        "variance" : 6.528151949328301E-4,
                        "std_deviation" : 0.025550248431919994,
                        "variance_sampling" : 6.529158603445391E-4
                      }
                    }
                  },
                  "to_as_string" : "2023-04-26T19:09:27.510Z",
                  "from" : 1.68253256751E12,
                  "to" : 1.68253616751E12,
                  "STATS_AVG" : {
                    "value" : 0.0031437093803853506
                  },
                  "STATS_STD" : {
                    "value" : 0.025550248431919994
                  }
                },
                "8D" : {
                  "from_as_string" : "2023-04-26T20:09:27.510Z",
                  "doc_count" : 7759,
                  "FDZ_MODEL" : {
                    "doc_count" : 14610,
                    "FDZ_MODEL_TYPE" : {
                      "doc_count" : 6048,
                      "STATS" : {
                        "variance_population" : 9.636887215807632E-4,
                        "std_deviation_bounds" : {
                          "upper_population" : 0.06550982826637342,
                          "upper" : 0.06550982826637342,
                          "lower" : -0.05866351647915646,
                          "lower_population" : -0.05866351647915646,
                          "upper_sampling" : 0.06551496172972278,
                          "lower_sampling" : -0.05866864994250583
                        },
                        "max" : 0.919407844543457,
                        "count" : 6048,
                        "sum" : 20.703246844544083,
                        "std_deviation_population" : 0.03104333618638247,
                        "sum_of_squares" : 5.899259829573189,
                        "std_deviation_sampling" : 0.03104590291805715,
                        "min" : 3.999716227554018E-6,
                        "avg" : 0.003423155893608479,
                        "variance" : 9.636887215807632E-4,
                        "std_deviation" : 0.03104333618638247,
                        "variance_sampling" : 9.638480879974296E-4
                      }
                    }
                  },
                  "to_as_string" : "2023-04-26T21:09:27.510Z",
                  "from" : 1.68253976751E12,
                  "to" : 1.68254336751E12,
                  "STATS_AVG" : {
                    "value" : 0.003423155893608479
                  },
                  "STATS_STD" : {
                    "value" : 0.03104333618638247
                  }
                }
              }
            }
          }
        }

can anyone help to access the bucket value properly.

Appreciate your help.
Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.