Accessing search result (index_out_of_bounds

Elastic Stack Elasticsearch
1

Hi there,

When trying out the watcher, we would like to add info we collected in the input to a webhook POST request. We are trying to use the ctx.payload.hits.hits (with or without any index number).
Unfortunately, every time we are getting an index_out_of_bound_exception. Our query gets over 400 hits.
What can we do to get the information we're requesting in the body of our webhook?

2

the correct value would be ctx.payload.hits.hits - however, whenever such a kind of problem arises, the best thing would be to paste the output of the execute watch API in a gist.

--Alex

4

Hi Alex,
Thanks for your reply. This is the output we're getting:

    "condition": {
  "type": "compare",
  "status": "success",
  "met": true,
  "compare": {
    "resolved_values": {
      "ctx.payload.hits.total": 427
    }
  }
},
"actions": [
  {
    "id": "enterpriseAlert",
    "type": "webhook",
    "status": "failure",
    "error": {
      "root_cause": [
        {
          "type": "general_script_exception",
          "reason": "Error running com.github.mustachejava.codes.DefaultMustache@246918af"
        }
      ],
      "type": "general_script_exception",
      "reason": "Error running com.github.mustachejava.codes.DefaultMustache@246918af",
      "caused_by": {
        "type": "mustache_exception",
        "reason": "Failed to get value for ctx.payload.hits.hits.1 @[query-template:1]",
        "caused_by": {
          "type": "mustache_exception",
          "reason": "1 @[query-template:1]",
          "caused_by": {
            "type": "index_out_of_bounds_exception",
            "reason": "1"
          }
        }
      }
    }
  }
]
5

please include the full response, this misses a lot of things. Thanks!

6

I'm sorry. Here it is:

{
  "watch_id": "_inlined_",
  "node": "xAY0l29iSGKCuZOPmASWdQ",
  "state": "executed",
  "status": {
"state": {
  "active": true,
  "timestamp": "2018-04-25T16:05:03.894Z"
},
"last_checked": "2018-04-25T16:05:03.894Z",
"last_met_condition": "2018-04-25T16:05:03.894Z",
"actions": {
  "enterpriseAlert": {
    "ack": {
      "timestamp": "2018-04-25T16:05:03.894Z",
      "state": "awaits_successful_execution"
    },
    "last_execution": {
      "timestamp": "2018-04-25T16:05:03.894Z",
      "successful": false,
      "reason": ""
    }
  }
},
"execution_state": "executed",
"version": -1
  },
  "trigger_event": {
"type": "manual",
"triggered_time": "2018-04-25T16:05:03.894Z",
"manual": {
  "schedule": {
    "scheduled_time": "2018-04-25T16:05:03.894Z"
  }
}
  },
  "input": {
"search": {
  "request": {
    "search_type": "query_then_fetch",
    "indices": [
      "pymon*"
    ],
    "types": [],
    "body": {
      "size": 0,
      "query": {
        "bool": {
          "must": {
            "match": {
              "type": "Microsoft.ServiceFabric/clusters"
            }
          },
          "must_not": {
            "match": {
              "properties.clusterState": "Available"
            }
          },
          "should": [
            {
              "range": {
                "date_time": {
                  "gte": "now-5m/m"
                }
              }
            }
          ]
        }
      }
    }
  }
}
  },
  "condition": {
"compare": {
  "ctx.payload.hits.total": {
    "gte": 1
  }
}
  },
  "metadata": {
"name": "Check the status of Service Fabric",
"xpack": {
  "type": "json"
}
  },
  "result": {
"execution_time": "2018-04-25T16:05:03.894Z",
"execution_duration": 4,
"input": {
  "type": "search",
  "status": "success",
  "payload": {
    "_shards": {
      "total": 15,
      "failed": 0,
      "successful": 15,
      "skipped": 0
    },
    "hits": {
      "hits": [],
      "total": 430,
      "max_score": 0
    },
    "took": 2,
    "timed_out": false
  },
  "search": {
    "request": {
      "search_type": "query_then_fetch",
      "indices": [
        "pymon*"
      ],
      "types": [],
      "body": {
        "size": 0,
        "query": {
          "bool": {
            "must": {
              "match": {
                "type": "Microsoft.ServiceFabric/clusters"
              }
            },
            "must_not": {
              "match": {
                "properties.clusterState": "Available"
              }
            },
            "should": [
              {
                "range": {
                  "date_time": {
                    "gte": "now-5m/m"
                  }
                }
              }
            ]
          }
        }
      }
    }
  }
},
"condition": {
  "type": "compare",
  "status": "success",
  "met": true,
  "compare": {
    "resolved_values": {
      "ctx.payload.hits.total": 430
    }
  }
},
"actions": [
  {
    "id": "enterpriseAlert",
    "type": "webhook",
    "status": "failure",
    "error": {
      "root_cause": [
        {
          "type": "general_script_exception",
          "reason": "Error running com.github.mustachejava.codes.DefaultMustache@246918af"
        }
      ],
      "type": "general_script_exception",
      "reason": "Error running com.github.mustachejava.codes.DefaultMustache@246918af",
      "caused_by": {
        "type": "mustache_exception",
        "reason": "Failed to get value for ctx.payload.hits.hits.1 @[query-template:1]",
        "caused_by": {
          "type": "mustache_exception",
          "reason": "1 @[query-template:1]",
          "caused_by": {
            "type": "index_out_of_bounds_exception",
            "reason": "1"
          }
        }
      }
    }
  }
]
  },
  "messages": []
}
7

now everything is clear. By specifying size: 0 in your request you explicitely did not want to have the data structure in your response, you are trying to access in your action. This is why the array is emtpy.

8

Oh god. Well, that's a stupid error. Thanks for helping me solving it!
After looking it up I found out that it isn't even a required field.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.