Understood now! Appreciate the clarity.
I'm making progress toward fetching the "observer.names" (syslog sending hosts) - and appears script is demonstrating results.
I need some assistance in formatting and sharpening the output.
How do we extract the 'observer.name
' - so that I customize an alert upon "match" of this (alerter approach is one way)
OR
Execute an email from Watcher , inclusive of the "flatlined" sending 'observer.name'
when conditions match?
I realize the {{ctx.payload.hits}}
is not the field I need, but it's the location I'd like the the 'observer.name'
to be. Is it '_source.observer.name'
?
//
"text": "Systems not responding in the last {{ctx.metadata.last_period}} minutes:{{#ctx.payload._value}}{{.}}:{{/ctx.payload._value}} {{ctx.payload.hits}}
//
The watcher json:
{
"metadata": {
"window_period": "24h",
"last_period":"5m"
},
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"indices": "filebeat-*",
"body": {
"query": {
"range": {
"@timestamp": {
"gte": "now-{{ctx.metadata.window_period}}"
}
}
},
"aggs": {
"periods": {
"filters": {
"filters": {
"history": {
"range": {
"@timestamp": {
"gte": "now-{{ctx.metadata.window_period}}"
}
}
},
"last_period": {
"range": {
"@timestamp": {
"gte": "now-{{ctx.metadata.last_period}}"
}
}
}
}
},
"aggs": {
"hosts": {
"terms": {
"field": "observer.name",
"size": 10000
}
}
}
}
},
"size": 0
}
}
}
},
"condition": {
"script": "return true"
},
"throttle_period": "5m",
"actions": {
"log": {
"transform": {
"script": "return true"
},
"logging": {
"text": "Systems not responding in the last {{ctx.metadata.last_period}} minutes:{{#ctx.payload._value}}{{.}}:{{/ctx.payload._value}} {{ctx.payload.hits}}"
}
}
}
}
Simulated Results:
> {
> "watch_id": "_inlined_",
> "node": "_KlItRP8Qp27WSYwbMYzsw",
> "state": "executed",
> "user": "elastic",
> "status": {
> "state": {
> "active": true,
> "timestamp": "2021-03-08T20:49:58.502Z"
> },
> "last_checked": "2021-03-08T20:49:58.503Z",
> "last_met_condition": "2021-03-08T20:49:58.503Z",
> "actions": {
> "log": {
> "ack": {
> "timestamp": "2021-03-08T20:49:58.503Z",
> "state": "ackable"
> },
> "last_execution": {
> "timestamp": "2021-03-08T20:49:58.503Z",
> "successful": true
> },
> "last_successful_execution": {
> "timestamp": "2021-03-08T20:49:58.503Z",
> "successful": true
> }
> }
> },
> "execution_state": "executed",
> "version": -1
> },
> "trigger_event": {
> "type": "manual",
> "triggered_time": "2021-03-08T20:49:58.503Z",
> "manual": {
> "schedule": {
> "scheduled_time": "2021-03-08T20:49:58.503Z"
> }
> }
> },
> "input": {
> "search": {
> "request": {
> "search_type": "query_then_fetch",
> "indices": [
> "filebeat-*"
> ],
> "rest_total_hits_as_int": true,
> "body": {
> "query": {
> "range": {
> "@timestamp": {
> "gte": "now-{{ctx.metadata.window_period}}"
> }
> }
> },
> "aggs": {
> "periods": {
> "filters": {
> "filters": {
> "history": {
> "range": {
> "@timestamp": {
> "gte": "now-{{ctx.metadata.window_period}}"
> }
> }
> },
> "last_period": {
> "range": {
> "@timestamp": {
> "gte": "now-{{ctx.metadata.last_period}}"
> }
> }
> }
> }
> },
> "aggs": {
> "hosts": {
> "terms": {
> "field": "observer.name",
> "size": 10000
> }
> }
> }
> }
> },
> "size": 0
> }
> }
> }
> },
> "condition": {
> "script": {
> "source": "return true",
> "lang": "painless"
> }
> },
> "metadata": {
> "last_period": "5m",
> "window_period": "24h",
> "name": "testtest",
> "xpack": {
> "type": "json"
> }
> },
> "result": {
> "execution_time": "2021-03-08T20:49:58.503Z",
> "execution_duration": 472,
> "input": {
> "type": "search",
> "status": "success",
> "payload": {
> "_shards": {
> "total": 53,
> "failed": 0,
> "successful": 53,
> "skipped": 49
> },
> "hits": {
> "hits": [],
> "total": 10000,
> "max_score": null
> },
> "took": 470,
> "timed_out": false,
> "aggregations": {
> "periods": {
> "buckets": {
> "last_period": {
> "doc_count": 42242,
> "hosts": {
> "doc_count_error_upper_bound": 0,
> "sum_other_doc_count": 0,
> "buckets": [
> {
> "doc_count": 3619,
> "key": "FortiGate-60F"
> },
> {
> "doc_count": 3524,
> "key": "NC-Firewall"
> },
> {
> "doc_count": 982,
> "key": "TexasFG"
> },
> {
> "doc_count": 4,
> "key": "ok-int-wall2600"
> }
> ]
> }
> },
> "history": {
> "doc_count": 7415336,
> "hosts": {
> "doc_count_error_upper_bound": 0,
> "sum_other_doc_count": 0,
> "buckets": [
> {
> "doc_count": 519864,
> "key": "FortiGate-60F"
> },
> {
> "doc_count": 400606,
> "key": "NC-Firewall"
> },
> {
> "doc_count": 148454,
> "key": "TexasFG"
> },
> {
> "doc_count": 1176,
> "key": "ok-int-wall2600"
> }
> ]
> }
> }
> }
> }
> }
> },
> "search": {
> "request": {
> "search_type": "query_then_fetch",
> "indices": [
> "filebeat-*"
> ],
> "rest_total_hits_as_int": true,
> "body": {
> "query": {
> "range": {
> "@timestamp": {
> "gte": "now-24h"
> }
> }
> },
> "aggs": {
> "periods": {
> "filters": {
> "filters": {
> "history": {
> "range": {
> "@timestamp": {
> "gte": "now-24h"
> }
> }
> },
> "last_period": {
> "range": {
> "@timestamp": {
> "gte": "now-5m"
> }
> }
> }
> }
> },
> "aggs": {
> "hosts": {
> "terms": {
> "field": "observer.name",
> "size": 10000
> }
> }
> }
> }
> },
> "size": 0
> }
> }
> }
> },
> "condition": {
> "type": "script",
> "status": "success",
> "met": true
> },
> "actions": [
> {
> "id": "log",
> "type": "logging",
> "status": "simulated",
> "transform": {
> "type": "script",
> "status": "success",
> "payload": {
> "_value": true
> }
> },
> "logging": {
> "logged_text": "Systems not responding in the last 5m minutes:true: "
> }
> }
> ]
> },
> "messages": []
> }