I created a new watch for altering the output of a machine learning job. The watch JSON looks like below.
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"http": {
"request": {
"scheme": "http",
"host": "localhost",
"port": 9200,
"method": "get",
"path": "/_xpack/ml/anomaly_detectors/total-requests/results/buckets",
"params": {},
"headers": {},
"body": "{ "anomaly_score": 75, "start": "{{ctx.payload.time}}" }"
}
}
},
"condition": {
"always": {}
},
"actions": {
"notify-slack": {
"throttle_period_in_millis": 300000,
"slack": {
"message": {
"to": [
"#test-alerts"
],
"text": "New anomaly detected with score {{ctx.payload.score}}."
}
}
}
},
"transform": {
"script": {
"source": "return [ 'time' : Instant.ofEpochMilli(ctx.execution_time.getMillis()).minus(1, ChronoUnit.HOURS)]",
"lang": "painless"
}
}
}
However when the watch is triggered, it raises the following error:
{
"result": {
"execution_time": "2019-03-21T16:05:40.768Z",
"execution_duration": 6,
"input": {
"type": "http",
"status": "success",
"payload": {
"_headers": {
"content-type": [
"application/json; charset=UTF-8"
]
},
"error": {
"root_cause": [
{
"type": "parse_exception",
"reason": "failed to parse date field with format [strict_date_optional_time||epoch_millis]"
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [
{
"shard": 0,
"index": ".ml-anomalies-shared",
"node": "Hmt2nz5fQcSeBgdNmcEoVA",
"reason": {
"type": "parse_exception",
"reason": "failed to parse date field with format [strict_date_optional_time||epoch_millis]",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Parse failure at index [0] of "
}
}
}
]
},
"_status_code": 400,
"status": 400
},
"http": {
"request": {
"host": "localhost",
"port": 9200,
"scheme": "http",
"method": "get",
"path": "/_xpack/ml/anomaly_detectors/total-requests/results/buckets",
"body": "{ "anomaly_score": 75, "start": "" }"
},
"status_code": 400
}
},
"condition": {
"type": "always",
"status": "success",
"met": true
},
"transform": {
"type": "script",
"status": "success",
"payload": {
"time": "2019-03-21T15:05:40.768Z"
}
}
}
As it can be seen the script transformed the date value successfully, but the templating cannot insert it ("failed to parse date field with format [strict_date_optional_time||epoch_millis]"). If I copy the ctx.payload.time value and insert it into the body property, all works well.
So this seems to be a bug, unless I'm missing something.
What do you think?