Create dynamic date variable/constant to use in watch

alerting

(Viorel Florian) #1

I am trying to create a metadata field of type date to use in input, condition, action :
"metadata": { "range_start" : "now-10m" }
In the input it seems to have the desired.

In the action I am trying to use range_start as so:
from:{{ctx.metadata.range_start}},mode:absolute,to:{{ctx.trigger.triggered_time}}
but the result is:
(from:now-10m,mode:absolute,to:2018-01-11T10:38:27.509Z)
instead of:
(from:2018-01-11T10:28:27.509Z,mode:absolute,to:2018-01-11T10:38:27.509Z)

Any help is appreciated!


(Alexander Reelsen) #2

Hey,

this now expansion is done at query time on the Elasticsearch side, when the query is sent to Elasticsearch, not when the watch is executed.

Can you maybe explain in words, what exactly you are after and which part needs to be more dynamic than now-10m here and why?

Thank you!

--Alex


(Viorel Florian) #3

Hi @spinscale,
I am trying to

  1. include the value of "execution_time" and the value of "now-10m" in the email notification action.
  2. Ultimately I am trying to include a URL that will open Kibana to the search results that triggered the watch
    Any help is appreciated.
    Regards,
    Vio

(Alexander Reelsen) #4

Hey,

you can try using a script transform in your email action and calculate the time difference using a painless script. This is on top of my head, but should give you a first hint

        "transform" : {
          "script" : {
            "source" : "def payload = ctx.payload ; ctx.payload.tenminsago = Instant.ofEpochMilli(ctx.execution_time.getMillis() - (10 * 60 * 1000) ); return payload"
          }
        },

this converts a joda time into a java time object and substracts the number of milliseconds.

hope that helps.

--Alex


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.