Accessing Watcher Payload for Buckets

HI Community,

was working on a watch to compare the 7 days for errors.

now I only got the problem, how can i access it to compared it? :confused:

   "result": {
  "execution_time": "2017-04-21T12:32:53.804Z",
  "execution_duration": 418,
  "input": {
    "type": "search",
    "status": "success",
    "payload": {
      "_shards": {
        "total": 94,
        "failed": 0,
        "successful": 94
      },
      "hits": {
        "hits": [],
        "total": 12992972,
        "max_score": 0
      },
      "took": 416,
      "timed_out": false,
      "aggregations": {
        "servername": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": [
            {
              "doc_count": 1142334,
              "httperror": {
                "doc_count_error_upper_bound": 0,
                "sum_other_doc_count": 0,
                "buckets": [
                  {
                    "doc_count": 197,
                    "key": "404"
                  }
                ]
              },
              "key": "cnx-api00"
            }
          ]
        }
      }
    }

was trying to get the doc_count from httperror.

  "condition": {
"compare": {
  "ctx.payload.aggregations.servername.buckets.httperror.buckets.doc_count": {
    "lt": 600
  }
}

}

wasn't it possible to get the lower bucket or did I miss something?

Thanks for the Help in advance

Hey,

as the buckets is an array, you have to specify an index for the elements. One of the examples uses mustache to loop through the buckets and get the first sub bucket.

https://www.elastic.co/guide/en/x-pack/5.3/watching-meetup-data.html

I did not understand your last sentence though.

Hope this helps!

--Alex

Hey spinscale,

yep thanks, now it works :slight_smile:

was already confused at the last sentence for late friday.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.