Cannot divide multiple context values in Elasticsearch watcher

I have created a watch in Elasticsearch to alert me if the ratio of http errors is greater than 15% of total requests over 60 minutes. I am using chain inputs to generate the dividend and divisor values for my ratio calculation.

In my condition I am using scripting to do the division and check if it is greater than my ratio.

However, whenever I use 2 ctx parameters to do the division, it always equals to zero.

If I play with it and only use one of ctx param, then it works fine.

It seems that we cannot use 2 ctx params in a condition.

Does anyone know how to get around this?

Below is my watch.

Thanks.

{
  "trigger" : {
    "schedule" : {
      "interval" : "5m"
    }
  },
  "input" : {
    "chain":{
      "inputs": [
      {
        "first": {
          "search" : {
            "request" : {
              "indices" : [ "logstash-*" ],
              "body" : {
                "query" : { 
                  "bool":{
                    "must": [
                      {
                      "match" : {"d.uri": "xxxxxxxx"}
                      },
                      { 
                      "match" : {"topic": "xxxxxxxx"}
                      }
                    ],
                    "filter": {
                      "range": {
                        "@timestamp": {
                          "gte": "now-60m"
                        }
                      }
                    }
                  }
                }
              }
            },
            "extract": ["hits.total"]
          }
        }
      },
      {
        "second": {
          "search" : {
            "request" : {
              "body" : {
                "query" : { 
                  "bool":{
                    "must": [
                      {
                      "match" : {"d.uri": "xxxxxxxx"}
                      },
                      { 
                      "match" : {"topic": "xxxxxxxx"}
                      },
                      { 
                      "match" : {"d.status": "401"}
                      }
                    ],
                    "filter": {
                      "range": {
                        "@timestamp": {
                          "gte": "now-60m"
                        }
                      }
                    }
                  }
                }
              }
            },
            "extract": ["hits.total"]
          }
        }
      }
      ]
    }
  },
  "condition" : {
    "script" : {
      "source" : "return (ctx.payload.second.hits.total / ctx.payload.first.hits.total) == 0"
    }
  }
}

The issue comes in fact from the fact that I was doing an integer division to get to a ratio in the form of 0.xx. I reversed the operation and it is working fine.

Thanks for updating with your solution!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.