"compare" : { "ctx.payload.hits.total" : { "gt" : 5}} is not working

alerting

(Gayathri TR) #1

Hi Team,

"compare" : { "ctx.payload.hits.total" : { "gt" : 5}} is not working for me while creating the watch alert. We are getting mail alerts if we remove the below block:

"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 5}}
},

tried:

"condition" : {
"script" : "return ctx.payload.hits.total > 5"
}
as well. But the condition block is not working. PFB, the complete watcher request:

{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"body" : {
"query" : {
"match" : { "Status": "404" }
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 5}}
},
"actions" : {
"send_email" : {
"email" : {
"to" : "mail.dns.com",
"subject" : "Test",
"body" : " Test"
}
}
}
}

Thanks,
Gayathri


(Gayathri TR) #2

Team,

Could see "ctx.payload.hits.total" is always taking as "0". Kindly help me to get the exact count.


(Alexander Reelsen) #3

please include the full output of the execute watch API here, this will make debugging a lot easier. Also please include the full watch here. And please use proper formatting, as you can just use markdown.

--Alex


(Gayathri TR) #4

Hi,

That issue got resolved by adding "search_type": "query_then_fetch" in input.

But having another issue, ctx.payload.hits.total is taking all the hits but not according to the query in the input.

So when we trigger for an error scenario with Success cases it is taking the count for both.

{
"trigger": {
"schedule": {
"interval": "30s"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"index*"
],
"types": [],
"body": {
"query": {
"bool": {
"must": {
"match": {
"message": "status ~ 404"
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gte": "now-30s"
}
}
}
]
}
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 5
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"mail.domain.com"
],
"subject": "ALERT",
"body": {
"text": "Found {{ctx.payload.hits.total}} errors in the logs "
}
}
}
}
}

Kindly help on the above issue.


(Gayathri TR) #5

Kindly help me on the above


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.