Hi all, I am trying to aggregate ctx source fields (triggered source event fields) and force watcher to write them to watcher-history index. For eg i wanna pass the ctx.payload.hits.hits.0._source.computer_name of a winlogbeat as new field to the watcher-history index. Is there a way? I tried tran…

the watcher history index mapping should not be fiddled with. However, all the results of a search are already written into a watch record (the name for a single entry in the history), albeit not searchable. If you need to have this searchable you should probably reindex the data in your own index.…

I need to write ctx.payload.hits.hits.0._source.field or result.input.payload.hits.hits fields (if accessible) to watcher-history index or another index if it is possible and write watches that correlates the correlated events. I understand why i shouldn't write to watcher-history index but i need …

How about using the index action to write to an index you maintain yourself?

I will try something like that: "index_payload": { "index": { "index": "correlated", "doc_type": "data" } } This will populate the fields from the watch ?

the current payload will be used, but you may likely want to use a script transform before the action is executed. There is even support to index into multiple documents, see https://www.elastic.co/guide/en/x-pack/6.2/actions-index.html

I tried transforming a field. "index_payload": { "transform": { "script": { "source": "[ 'sourceHostname' : ctx.payload.hits.hits.0._source.computer_name ]", "lang": "painless" } }, "index": { "index": "correlated", "doc_type": "data" } } Watch got a hit the result was the following: {…

Update: Only sourceHostname is populated in the index . Is there a way to loop with transform to extract all fields and populated the recursively? Thanks for any help

Do you want to have all source hostnames? def hostnames = ctx.payload.hits.hits.stream().map(hit -> hit._source.computer_name).collect(Collectors.toList());

Nope i want all the field from the hit to populated to the new index through a transform loop. And not add them manually. Or maybe pass someway the hits json as a whole? I am not sure which way is better. An example could help. Thanks again

well, then dont filter on the field name but just use the whole _source in the above example. We have a couple of examples , you might want to take a look at. As you are testing with out own data, I think the most important part would be to reduce your feedback loop while testing. I wrote a longish…

Ctx.payload.hits.hits.0._source.field to watcher-history index

Elastic Stack Elasticsearch

Topic		Replies	Views
Sending data to existing elasticsearch index through Watcher Elasticsearch elastic-stack-alerting	7	831	June 1, 2020
Watcher with Index Action - Not writing data properly Kibana	16	2308	June 18, 2020
How to index all fields using index action type in Watchers transform? Elasticsearch elastic-stack-alerting	2	425	September 29, 2020
Watcher results into new index Elasticsearch elastic-stack-alerting	3	1070	September 19, 2019
Watch-history fieldname error Elasticsearch elastic-stack-alerting	9	1072	March 3, 2017

Ctx.payload.hits.hits.0._source.field to watcher-history index

Related topics