Accessing Watcher Payload for Buckets

Elastic Stack Elasticsearch
1

HI Community,

was working on a watch to compare the 7 days for errors.

now I only got the problem, how can i access it to compared it? :confused:

   "result": {
  "execution_time": "2017-04-21T12:32:53.804Z",
  "execution_duration": 418,
  "input": {
    "type": "search",
    "status": "success",
    "payload": {
      "_shards": {
        "total": 94,
        "failed": 0,
        "successful": 94
      },
      "hits": {
        "hits": [],
        "total": 12992972,
        "max_score": 0
      },
      "took": 416,
      "timed_out": false,
      "aggregations": {
        "servername": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": [
            {
              "doc_count": 1142334,
              "httperror": {
                "doc_count_error_upper_bound": 0,
                "sum_other_doc_count": 0,
                "buckets": [
                  {
                    "doc_count": 197,
                    "key": "404"
                  }
                ]
              },
              "key": "cnx-api00"
            }
          ]
        }
      }
    }

was trying to get the doc_count from httperror.

  "condition": {
"compare": {
  "ctx.payload.aggregations.servername.buckets.httperror.buckets.doc_count": {
    "lt": 600
  }
}

}

wasn't it possible to get the lower bucket or did I miss something?

Thanks for the Help in advance

2

Hey,

as the buckets is an array, you have to specify an index for the elements. One of the examples uses mustache to loop through the buckets and get the first sub bucket.

https://www.elastic.co/guide/en/x-pack/5.3/watching-meetup-data.html

I did not understand your last sentence though.

Hope this helps!

--Alex

3

Hey spinscale,

yep thanks, now it works :slight_smile:

was already confused at the last sentence for late friday.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.