I am executing the below watch and want to compare the values of bucket 1D from the aggregation in the watcher condition. However, I am getting errors while accessing the value.
POST _watcher/watch/_execute
{
"watch":
{
"trigger": {
"schedule": {
"interval": "1d"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"index"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"rtd.TIME": {
"gte": "now-9d",
"lte": "now"
}
}
}
]
}
},
"aggs": {
"DATE_RANGE": {
"date_range": {
"field": "rtd.XCN_DATE_TIME",
"keyed": true,
"ranges": [
{
"key": "1D",
"from": "2023-04-26T18:09:27.510Z",
"to": "2023-04-26T19:09:27.510Z"
},
{
"key": "8D",
"from": "2023-04-26T20:09:27.510Z",
"to": "2023-04-26T21:09:27.510Z"
}
]
},
"aggs": {
"FDZ_MODEL": {
"nested": {
"path": "score.fdz.models"
},
"aggs": {
"FDZ_MODEL_TYPE": {
"filter": {
"term": {
"score.fdz.models.modelName": "EMD_TMX_BROWSER"
}
},
"aggs": {
"STATS": {
"extended_stats": {
"field": "score.fdz.models.score"
}
}
}
}
}
},
"STATS_AVG": {
"bucket_script": {
"buckets_path": {
"AVG": "FDZ_MODEL>FDZ_MODEL_TYPE>STATS.avg"
},
"script": "params.AVG"
}
},
"STATS_STD": {
"bucket_script": {
"buckets_path": {
"STD": "FDZ_MODEL>FDZ_MODEL_TYPE>STATS.std_deviation"
},
"script": "params.STD*1"
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
**"source": "ctx.payload.aggregations.DATE_RANGE.buckets.1D.doc_count > params.threshold"**,
"lang": "painless",
"params": {
"threshold": 5
}
}
},
"actions": {
"send_email": {
"email": {
"account": "exchange_account",
"profile": "standard",
"to": [
"rahul.r.kothanath@gmail.com"
],
"subject": "Kibana-Alert[Feed Score Variation]",
"body": {
"text": "flow having abnormal variations and please have a look"
}
}
}
}
}
}
I am trying to access the doc_count of bucket 1D but it is throwing below error.
"script_stack" : [
"... ions.DATE_RANGE.buckets.1D.doc_count > params.thre ...",
" ^---- HERE"
],
"script" : "ctx.payload.aggregations.DATE_RANGE.buckets.1D.doc_count > params.threshold",
"lang" : "painless",
"position" : {
"offset" : 45,
"start" : 20,
"end" : 70
},
"caused_by" : {
"type" : "illegal_argument_exception",
"reason" : "unexpected token ['D'] was expecting one of [{<EOF>, ';'}]."
}
},
Below is the watcher result.
"payload" : {
"_shards" : {
"total" : 10,
"failed" : 0,
"successful" : 10,
"skipped" : 0
},
"hits" : {
"hits" : [ ],
"total" : 10000,
"max_score" : null
},
"took" : 4733,
"timed_out" : false,
"aggregations" : {
"DATE_RANGE" : {
"buckets" : {
"1D" : {
"from_as_string" : "2023-04-26T18:09:27.510Z",
"doc_count" : 8384,
"FDZ_MODEL" : {
"doc_count" : 15898,
"FDZ_MODEL_TYPE" : {
"doc_count" : 6486,
"STATS" : {
"variance_population" : 6.528151949328301E-4,
"std_deviation_bounds" : {
"upper_population" : 0.05424420624422534,
"upper" : 0.05424420624422534,
"lower" : -0.04795678748345464,
"lower_population" : -0.04795678748345464,
"upper_sampling" : 0.05424814599187884,
"lower_sampling" : -0.04796072723110814
},
"max" : 0.9284928441047668,
"count" : 6486,
"sum" : 20.390099041179383,
"std_deviation_population" : 0.025550248431919994,
"sum_of_squares" : 4.2982598999570785,
"std_deviation_sampling" : 0.025552218305746745,
"min" : 4.836584594158921E-6,
"avg" : 0.0031437093803853506,
"variance" : 6.528151949328301E-4,
"std_deviation" : 0.025550248431919994,
"variance_sampling" : 6.529158603445391E-4
}
}
},
"to_as_string" : "2023-04-26T19:09:27.510Z",
"from" : 1.68253256751E12,
"to" : 1.68253616751E12,
"STATS_AVG" : {
"value" : 0.0031437093803853506
},
"STATS_STD" : {
"value" : 0.025550248431919994
}
},
"8D" : {
"from_as_string" : "2023-04-26T20:09:27.510Z",
"doc_count" : 7759,
"FDZ_MODEL" : {
"doc_count" : 14610,
"FDZ_MODEL_TYPE" : {
"doc_count" : 6048,
"STATS" : {
"variance_population" : 9.636887215807632E-4,
"std_deviation_bounds" : {
"upper_population" : 0.06550982826637342,
"upper" : 0.06550982826637342,
"lower" : -0.05866351647915646,
"lower_population" : -0.05866351647915646,
"upper_sampling" : 0.06551496172972278,
"lower_sampling" : -0.05866864994250583
},
"max" : 0.919407844543457,
"count" : 6048,
"sum" : 20.703246844544083,
"std_deviation_population" : 0.03104333618638247,
"sum_of_squares" : 5.899259829573189,
"std_deviation_sampling" : 0.03104590291805715,
"min" : 3.999716227554018E-6,
"avg" : 0.003423155893608479,
"variance" : 9.636887215807632E-4,
"std_deviation" : 0.03104333618638247,
"variance_sampling" : 9.638480879974296E-4
}
}
},
"to_as_string" : "2023-04-26T21:09:27.510Z",
"from" : 1.68253976751E12,
"to" : 1.68254336751E12,
"STATS_AVG" : {
"value" : 0.003423155893608479
},
"STATS_STD" : {
"value" : 0.03104333618638247
}
}
}
}
}
}
can anyone help to access the bucket value properly.
Appreciate your help.
Thanks