Cannot Run Scripted_mertic in elastic watcher input part

[JasonREC]

Hi, I am trying to set up a watcher and iterate throught my index. I have a search query which return buckets(region) inside another buckets(pa_key). The inside bucket (region) has a value called ac_count and av_count. And I want to see if they are over 50, if either value is over 50, I am going to store that related pa_key, region and ac_count and av_count into the state list, and eventually send this list via email to me

The is the pure query response without adding scripted metric:

This is the query script after adding scripted metric:

this is the response from mock watcher, and it return failed message

Could anyone help me out?

Thank you

[richcollier]

I would either:

a) Use a bucket_selector aggregation (link) to only return the buckets that meet your threshold.

b) Set the threshold in the condition section, like this watch

[JasonREC]

Hi, @richcollier

Both way are very helpful and easy to understand. I went for the (b) approach and and it does satisfy my need. In that example, it shows to use log action to do a final script transform( use if condition to filter out the bucket I don't need) before return the result to the user. I wonder if I can even further send that result via email to myself. it would be like trigger 2 action in order. First, log action -> Second email action.

[richcollier]

In the examples that I usually publish, I always pick the log action because I'm not doing the examples to show the notification capabilities of Watcher, but rather am focusing on the query, aggregation, and formatting of the results via the transform block.

So, feel free to replace the logging action with an email one. An email action can have its own action-level transform block for formatting the data

[JasonREC]

Hi @richcollier ,

Thanks for helping! now everything works as expected !