Cannot access the search results through the watch execution context - Ctx.payload.hits.total

Elastic Stack Elasticsearch
1

I'm trying to access value from {{ctx.payload.hits.total}}(Search Input | X-Pack for the Elastic Stack) and send message to Slack Action | X-Pack for the Elastic Stack), yet not getting any values(

Get Watch@Pastebin

Please advise.

2

can you paste the output of the Execute Watch API?

thanks!

3

Execute Watch@Pastebin

4

the output shows a successful execution, not a failed one. Check the result output field. the condition is met and the slack action was executed successfully.

--Alex

5

from results:

  "actions": [
    {
      "id": "slack_1",
      "type": "slack",
      "status": "success",
      "slack": {
        "account": "monitoring",
        "sent_messages": [
          {
            "status": "success",
            "to": "test",
            "message": {
              "from": "9c644ed6-51bf-47ed-8dd6-7ae33e08f9ed",
              "text": "Watch [Logstash] has exceeded the threshold\n "
            }
          }
        ]
      }
    }
  ]

from my watch:

"actions": {
  "slack_1": {
    "slack": {
      "message": {
        "to": [
          "test"
        ],
        "text": "Watch [{{ctx.metadata.name}}] has exceeded the threshold\n{{ctx.payload.hits.total}} {{ctx.metadata.*}}"
      }
    }
  }
},

and even though:

      "hits": {
        "hits": [],
        "total": 12683,
        "max_score": 0
      },

{{ctx.payload.hits.total}} returns empty.

Please advise.

6

You are running a transform script that changes the payload to result: 12683, so there is no payload.hits.total anymore in your action.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.