Check some condition for every document in buckets

Elastic Stack Elasticsearch
1

Hello all,

Can you advise/help about:

I use input chain in my Watcher. And I want to compare first, second, third etc.. doc_count of document from first input with first, second. third etc... doc_count of document form the second input respectively.
So I have such output:

            "hits": {
            "hits": [],
            "total": 911227,
            "max_score": 0
          },
          "took": 1345,
          "timed_out": false,
          "aggregations": {
            "operator": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 855146,
              "buckets": [
                {
                  "doc_count": 117,
                  "key": "Adam"
                },
                {
                  "doc_count": 2,
                  "key": "Tom"
                }
              ]
            }
          }
        },
        "second": {
          "_shards": {
            "total": 1490,
            "failed": 0,
            "successful": 1490,
            "skipped": 1408
          },
          "hits": {
            "hits": [],
            "total": 23458525,
            "max_score": 0
          },
          "took": 1748,
          "timed_out": false,
          "aggregations": {
            "operator": {
              "doc_count_error_upper_bound": 0,
              "sum_other_doc_count": 0,
              "buckets": [
                {
                  "doc_count": 127850,
                  "key": "Adam"
                },
                {
                  "doc_count": 161879,
                  "key": "Tom"
               .....

And I want to compare Adam doc_count from 1st input vs Adam doc_count from 2nd input, the same for Tom and if for any of them doc_count/doc_count > 1% notify me.
The problem is that amount of key in buckets (will be changed randomly) so I can't just use smth like (just put every possible document from bucket):

"condition": {
"script": {
"source": " ctx.vars.a = (ctx.payload.first.aggregations.operator.buckets.0.doc_count / ctx.payload.second.aggregations.operator.buckets.0.doc_count); ctx.vars.b = (ctx.payload.first.aggregations.operator.buckets.1.doc_count / ctx.payload.second.aggregations.operator.buckets.1.doc_count); if ((ctx.vars.a > 0.01)||(ctx.vars.b > 0.01) return true; else return false;",
"lang": "painless" }}

2

Hey,

this indeed requires some transformation before the condition. I would walk through each of the requests and create a map for each of them, that consists of the key being the name and the doc count being the value. Then it is super easy to run the comparison by just going through the keys of that map.

Hope this helps.

--Alex

3

Hey Alex, Thanks for pointing direction how to do that.
For now honestly don't understand how to implement cause didn't use previously.
Will try to find good examples of transform and use it.

4

Hey,

the examples repo is a good start to check out more conditions and transforms.

--Alex

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.