Hi, below is my watcher content, its not working when add in transform section into it, the whole looping for ctx.payload.hits.hits is not working, the email receive only showing " The alert condition for 'OSB - ni-ecomm-wsc-cust-sync error was triggered:" . After remove the transform section, it's working again, the email receive showing all the results, please advise.
{
"trigger": {
"schedule": {
"interval": "1m"
}
} ,
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"websys-weblogic-*"
],
"types": [],
"body": {
"query": {
"bool": {
"must": [
{
"match_phrase": {
"message": "ni-ecomm-wsc-cust-sync error"
}
},
{
"match": {
"fields.env": "prod"
}
},
{
"wildcard": {
"source.keyword": "/opt/apps/logs/osb-server/weblogic/osb-server*.log"
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-15m"
}
}
}
]
}
},
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"xxx@xxx.com"
],
"subject": "(ElasticSearch) OSB - ni-ecomm-wsc-cust-sync error",
"body": {
"html": "<html><h3>The alert condition for 'OSB - ni-ecomm-wsc-cust-sync error was triggered:</h3></html><br>{{#ctx.payload.hits.hits}}\tDate: {{_source.@timestamp}}<br>\tHostname:{{_source.host.name}}<br>\tMessage: {{_source.message}}<hr><br>{{/ctx.payload.hits.hits}}"
}
}
}
},
**"transform": {**
**"script": {**
**"source": "return[ctx.metadata.t1 = Instant.ofEpochMilli(ctx.execution_time.getMillis()).minus(15,** **ChronoUnit.MINUTES)]",**
**"lang": "painless"**
**}**
**},**
"throttle_period_in_millis": 14400000
}