Creating a watcher to compare a float value

Elastic Stack Elasticsearch
1

Hi,

Currently I am working on a watcher in Kibana 7.x. In here I need to compare a field (which is a float value) and perform an action. I am using a advanced watch for this requirement. Here I extract the field that I want and then compare it against a value. But the action is not triggered. Following is the JSON file of the watcher.

 {
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
            "indices": [
                "abc-*"
            ]
        },
        "extract" : ["amount"]
    }
  },
  "condition": {
    "compare": {
      "ctx.payload": {
        "gt": 10
      }
    }
  },
  
  "actions": {
    "my-logging-action": {
      "logging": {
        "text": "There are {{ctx.payload.hits.total}} documents in your index. amount is above 10."
      }
    }
  }
}

It is my pleasure if any one can correct my error.
Thanks.

1 Like
2

the extract part needs to include an exact path and not the field name within the _source field.

3

Hi @spinscale
Could you please tell me how to specify that path?

4

It seems that extraction currently does not work with array based elements, like the hits.hits array. I'll take a closer look and will open an issue.

Using hits.hits works. For now, it might be easiest to just not use any extraction or use source filtering as part of the search request.

5

Hi @spinscale,
Thanks for the quick replies. Is it possible to iterate the hits.hits array from watcher?

6

If you want to do that in the condition, take a look at the script condition.

Also, check out the Alerting examples for some inspiration.

7

Hi @spinscale,

Thanks you very much.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.