Count elements in JSON payload

Elastic Stack Kibana
1

Hello,
I'm trying to detect index on read-only with a watcher. I use http input, and I juste want to count the result.

My json watcher :

{
  "trigger": {
    "schedule": {
      "interval": "10m"
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "https",
        "host": "*****",
        "port": 9200,
        "method": "get",
        "path": "/*/_settings",
        "params": {
          "filter_path": "*.settings.index.blocks.read_only_allow_delete"
        },
        "headers": {},
        "auth": {
          "basic": {
            "username": "*****",
            "password": "*****"
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "warn",
        "text": "There are {{ctx.payload.hits.total}} read/only index"
      }
    }
  }
}

But in the result, the ctx.payload.hits.total is null (but i see correctly the index on read-only in the payload).

{
  "watch_id": "_inlined_",
  "node": "DzB7VTgaTGKh0oe8Lxt_oQ",
  "state": "execution_not_needed",
  "user": "*****",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-03-25T11:13:06.071Z"
    },
    "last_checked": "2021-03-25T11:13:06.071Z",
    "actions": {
      "my-logging-action": {
        "ack": {
          "timestamp": "2021-03-25T11:13:06.071Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "execution_not_needed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-03-25T11:13:06.071Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-03-25T11:13:06.071Z"
      }
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "https",
        "host": "*****",
        "port": 9200,
        "method": "get",
        "path": "/*/_settings",
        "params": {
          "filter_path": "*.settings.index.blocks.read_only_allow_delete"
        },
        "headers": {},
        "auth": {
          "basic": {
            "username": "*****",
            "password": "::es_redacted::"
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "metadata": {
    "name": "check-index-settings",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-03-25T11:13:06.071Z",
    "execution_duration": 29,
    "input": {
      "type": "http",
      "status": "success",
      "payload": {
        "_headers": {
          "content-length": [
            "103"
          ],
          "content-type": [
            "application/json; charset=UTF-8"
          ]
        },
        "_status_code": 200,
        "*****_i-000071": {
          "settings": {
            "index": {
              "blocks": {
                "read_only_allow_delete": "true"
              }
            }
          }
        }
      },
      "http": {
        "request": {
          "host": "*****",
          "port": 9200,
          "scheme": "https",
          "method": "get",
          "path": "/*/_settings",
          "params": {
            "filter_path": "*.settings.index.blocks.read_only_allow_delete"
          },
          "auth": {
            "basic": {
              "username": "*****",
              "password": "::es_redacted::"
            }
          }
        },
        "status_code": 200
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": false,
      "compare": {
        "resolved_values": {
          "ctx.payload.hits.total": null
        }
      }
    },
    "actions": []
  },
  "messages": []
}

Do you have any idea?

2

Your HTTP input calls an Elasticsearch API:

But your compare declaration is for parsing search results:

  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }

But your payload is an API response, not search results. You need to update the compare to something that will look for the results to be a non-empty object.

3

Thank you @tsullivan for your support.
I suppose I need to use "script" condition?
But I didn't find the way to use "ctx.payload".
The goal is not only to know if I have index on readonly, or not (empty response), but also to count how many index in this status.
Can you guide me please?

4

I think you just need to know the number of indices in the response, which I believe is a HashMap. Something like this might work:

  "condition": {
    "script": {
      "source": "return ctx.size()",
      "lang": "painless"
    }
  },

If you need further help, you'll have to take some time to learn Painless. Here is the documentation on HashMap: Shared API for package java.util | Painless Scripting Language [7.12] | Elastic

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.