Compile Error When Watcher Defination

Elastic Stack Kibana
1

Hello,
When i want to create below watcher definition, i get compile error. Is there any idea why i get compile error and how can i fix it ?

{
  "trigger": {
    "schedule": {
      "interval": "10m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "mfp.application-log*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "service.keyword": {
                      "value": "RL1C971D"
                    }
                  }
                },
                {
                  "term": {
                    "level.keyword": {
                      "value": "ERROR"
                    }
                  }
                },
                {
                  "range": {
                    "timestamp": {
                      "gt": "now-60m"
                    }
                  }
                }
              ],
              "boost": 1
            }
          },
          "aggs": {}
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "def previousState = ctx.metadata.previous_state ?: 'normal'; def currentTotal = ctx.payload.hits.total; if (currentTotal >= 10 && previousState == 'normal'){ctx.metadata.previous_state = 'critical'; return 'critical';} else if (currentTotal < 10 && previousState == 'critical') { ctx.metadata.previous_state = 'normal'; return 'normal'; } else { return 'none';}"
    }
  },
  "actions": {
    "my_webhook": {
      "condition":{
        "script":{
          "source": "ctx.payload.result == 'critical'"
        }
      },
      "webhook": {
        "scheme": "http",
        "host": "x",
        "port": 3,
        "method": "post",
        "path": "demo.com",
        "params": {},
        "headers": {
          "Content-Type": "application/x-www-form-urlencoded"
        },
        "body": "<BSMConnectorEvent><alertname>demoAlarm</alertname><domain>demo</domain><severity>Major</severity><relatedCI>demo</relatedCI><alertdetails> mail ile bilgi verilmelidir. Match count: {{ctx.payload.hits.total}}</alertdetails></BSMConnectorEvent>"
      }
    },
    "my_webhook2":{
      "condition":{
        "script":{
          "source": "ctx.payload.result == 'normal'"
        }
      },
       "webhook": {
        "scheme": "http",
        "host": "demo.com",
        "port": 3,
        "method": "post",
        "path": "x",
        "params": {},
        "headers": {
          "Content-Type": "application/x-www-form-urlencoded"
        },
        "body": "<BSMConnectorEvent><alertname>demo Alarm</alertname><domain>OC</domain><severity>Clear</severity><relatedCI>Kullandırım Değerlendirme İşlemleri Erişilebilirlik KPI</relatedCI><alertdetails>bilgi verilmelidir. Match count: {{ctx.payload.hits.total}}</alertdetails></BSMConnectorEvent>"
      }
    }
  }
}

Thanks

2

the script in the condition must return a boolean true or false. It cannot return arbitrary values like normal or critical

3

thank you.. you are right. It is solved. So can i ask one more thing that is important for me, i want to check if alert or normal condition is met. So i need to transfer a value from previous state to current state. what i mean that watcher running and State=Critical. I want to check this value in second running but i can't transfer. Why i want this, because i want to check alert state if threshold is met critical alert post otherwise clear alert post

4

If by "previous" state you mean the state of the situation the last time the watcher ran - then you must persist that knowledge somewhere outside of the Watch (as the Watch only has information about the current execution and any past execution is not "known"). So, you could:

  1. In the action section of the watch, in addition to doing a webhook call for the alert, also have a watcher index action to write the current state to an index, perhaps named mfp.alert-states
  2. Then, in the input section, you're going to actually have the watch create two different queries, via an input chain a) the query that you already have to the mfp.application-log* index looking for the data, but also b) a query to your alert state index (mfp.alert-states or whatever you call it)
  3. Then your condition can check the outputs of the two queries above and make a decision about alerting and updating the state index.

I don't have a full example, but I do have an example of an input chain that makes 3 separate queries and combines their results in a condition. Check it out here