Combining Painless and Mustache

Elastic Stack Elasticsearch
1

Can I make a template using both the painless script and mustache.
So as to make a search query where the search is done by mustache template and its done insde the painless language query.

2

Can you share an example of what you are trying to achieve with a sample document and query? I have a hard time to imagine the use-case :slight_smile:

3

I thought mustache is used for display purposes only. It has no effect on a search.
The aggregation used gives a multi-level aggregation results so it outputs some result

    "send_email": {
      "email": {
        "profile": "standard",
        "from": "example@example.com",
        "to": [
          "example@example.com"
        ],
        "subject": "Failed Login Exceeding",
        "body": {
          "text": """Failed Login Exceeding
{{#ctx.payload.aggregations.server_name.buckets}}
{{key.host_name}}
{{#events.buckets}}
    Time: {{key_as_string}}
    {{#user_name.buckets}}
          {{key}}    Count={{doc_count}}
    {{/user_name.buckets}}
{{/events.buckets}}

{{/ctx.payload.aggregations.server_name.buckets}}"""
        }
      }
    }

Output of email body is like this

           "body": {
              "text": "Failed Login Exceeding\nelk1\n    Time: 2022-02-10T04:42:00.000Z\n          guest    Count=3\n    Time: 2022-02-10T04:43:00.000Z\n          guest    Count=2\n\n"
            }

Looks like

Failed Login Exceeding
    elk1    
        Time: 2022-02-10T04:42:00.000Z
             guest    Count=3
        Time: 2022-02-10T04:43:00.000Z
             guest    Count=2
4

Yes, this is true, if you need to modify the data structure you want to use in the mustache template, you can use a script to do so, that should work in this case, unless I am missing a requirement.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.