Hi Team,
I have created a watcher to detect for failed status in a particular index, attached the screenshot for reference.
the watcher seems to be working fine, but when i have observed care fully the results are quite wrong.
in the discover section i could see 2 instances of failed keyword in last 24hrs but in my watcher simulate i am getting the count as 6.
Can any one please shed some light what i am doing wrong.
if i remove this piece of code "{ "range" : { "@timestamp" : { "from": "now-1d", "to": "now" } } }," from watcher i get the whole result as 93 which matches with my discover section.
watcher code :
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logs-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query" : {
"bool" : {
"filter" : [
{ "range" : { "@timestamp" : { "from": "now-1d", "to": "now" } } },
{ "match" : { "Status.keyword": "Failed" }}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
""
],
"subject": "Watcher Notification",
"body": {
"text": "{{ctx.payload.hits.total}}"
}
}
}
}
}
Simulate result --> removed the top lines
"result": {
"execution_time": "2022-03-02T16:07:48.513Z",
"execution_duration": 16,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 30,
"failed": 0,
"successful": 30,
"skipped": 0
},
"hits": {
"hits": [],
"total": 6,
"max_score": null
},
"took": 15,
"timed_out": false
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logs-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"from": "now-1d",
"to": "now"
}
}
},
{
"match": {
"Status.keyword": "Failed"
}
}
]
}
}
}
}
}
},
"condition": {
"type": "compare",
"status": "success",
"met": true,
"compare": {
"resolved_values": {
"ctx.payload.hits.total": 6
}
}
},
"actions": [
{
"id": "send_email",
"type": "email",
"status": "simulated",
"email": {
"message": {
"id": "send_email__inlined__5b16ca04-0632-427d-8c13-2c9c132ec8b0-2022-03-02T16:07:48.513492828Z_27",
"sent_date": "2022-03-02T16:07:48.530859562Z",
"to": [
"xxxx@gmail.com"
],
"subject": "Watcher Notification",
"body": {
"text": "6 "
}
}
}
}
]
},
"messages": []
}
