Any documentation on what ctx looks like?

alerting

(Daniel McGreal) #1

Hi all Watchers,

Is there some XPack documentation available that specifies the structure of the ctx object which can be accessed from scripts?

Thanks, Dan.


(Alexander Reelsen) #2

Hey,

so the context consists of several pieces

  • id, an execution id
  • watch_id - the id of the watch being executed
  • execution_time - the time the execution started
  • trigger - information about the trigger that caused this watch to be executed
  • payload - the payload from the inputs
  • metadata - optional configured metadata

If you want to find out the contents of all those fields, you could for example use the logging action and just output {{ctx}}...

--Alex


(Daniel McGreal) #3

Thanks!


(Mark Walkom) #4

FYI this is also documented here - https://www.elastic.co/guide/en/x-pack/current/how-watcher-works.html#watch-execution-context


(Vitaly) #5

I read these docs and ran a few tests, but I still don't understand how to include some fields or whole message from the query which match watcher condition, into Watcher notification(action).

https://www.elastic.co/guide/en/x-pack/current/input-search.html says: "To load all of the search hits into an email body, use ctx.payload.hits".
But I received just "ctx.payload.hits is {hits=[], total=1, max_score=0.0}"

TIA, Vitaly


(Alexander Reelsen) #6

Hey,

the ctx.payload field contains the response of the search request you executed in your input. If you execute a HTTP request against any service, this payload will change according to the response.

If a JSON response is returned from a request, this will be converted into nested data structure inside of the payload, like ctx.payload.hits, which then contains a hits array. However, your search did not yield any data in that data structure, very likely because you selected size: 0.

I hope this helps you to understand the concept behind ctx.payload

If there are further questions, please

  • open a new thread
  • provide the full watch you are testing with

Thanks!

--Alex


(system) #7