Ctx.payload.hits NOT working error (Good format)

Elastic Stack Elasticsearch
1

Hey there, I´m trying to create a watcher but i need to use some fields from my index to send that information via email but i always get the same error

I need to use the fields hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index in a body email then send it to other index

{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
".monitoring-es-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
{
"exists": {
"field": "node_stats"
}
}
]
}
},
"aggs": {
"metricAgg": {
"max": {
"field": "node_stats.jvm.mem.heap_used_percent"
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.metricAgg.value > params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 69
}
}
},
"actions": {
"email_action": {
"transform": {
"script": {
"source": "['items': ctx.payload.hits.collect(hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"lang": "painless"
}
},
"email": {
"profile": "standard",
"to": [
"ander.o@example.com"
],
"subject": "[{{ctx.metadata.name}}] node Heap: ({{ctx.payload.result}}%) > 85%",
"body": {
"html": """
Monitoring Cluster

The Alarm [{{ctx.metadata.name}}], detected excedeed 85% Heap usage of {{ctx.payload.result}} in the node {{NodeName}},

            <tr>
              <td>{{NodeName}}</td>
              <td>{{HostName}}</td>
              <td>{{Address}}<td>
              <td>{{ctx.payload.aggregations.metricAgg.value}}<td>
            </tr>          


    }
  }
}
},
"transform": {
"script": {
"source": "HashMap result = new HashMap(); result.result = ctx.payload.aggregations.metricAgg.value; return result;",
"lang": "painless",
"params": {
"threshold": 69
}
}
}
}

This is index

"hits" : [
{
"_index" : ".monitoring",
"_type" : "_doc",
"_id" : "IUHjJKJKJGvuyvytyiuhiuhuiho",
"_score" : 0.0,
"_source" : {
"@timestamp" : "2020-06-30T06:44:22.897Z",
"type" : "node_stats",
"event" : {
"module" : "elasticsearch",
},
"service" : {
"address" : "xxxxxx",
"type" : "elasticsearch"
},
"agent" : {
"name" : "XXXX",
,
"timestamp" : "2020-06-30T06:44:22.904Z",
"source_node" : {
"transport_address" : "192.128.1.0.0.0",
"name" : "master"
},
"ecs" : {
"version" : "1.7.0"
},
"id" : "3a81894984917881189",
"name" : "xxxx",
"hostname" : "xxxxx",
},
"node_stats" : {
"process" : {
"cpu" : {
"percent" : 0
},
"node_master" : true,
"jvm" : {
"mem" : {
"heap_used_in_bytes" : 20273711512,
"heap_used_percent" : 60,
"heap_max_in_bytes" : 33285996544
}
and the error is alway about

"caused_by": {
"type": "null_pointer_exception",
"reason": "Cannot invoke "Object.getClass()" because "callArgs[0]" is null"
}
}
},
"reason": "Failed to transform payload"

Here you have the error complete

{
"watch_id": "XXXXXXb",
"node": "XXXXX",
"state": "executed",
"user": "elastic",
"status": {
"state": {
"active": true,
"timestamp": "2021-07-30T10:46:25.268Z"
},
"last_checked": "2021-07-30T10:48:04.151Z",
"last_met_condition": "2021-07-30T10:48:04.151Z",
"actions": {
"email_action": {
"ack": {
"timestamp": "2020-07-30T10:46:25.268Z",
"state": "awaits_successful_execution"
},
"last_execution": {
"timestamp": "2021-07-30T10:48:04.151Z",
"successful": false,
"reason": "Failed to transform payload"
}
}
},
"execution_state": "executed",
"version": -1
},
"trigger_event": {
"type": "schedule",
"triggered_time": "2021-07-30T10:48:04.151Z",
"schedule": {
"scheduled_time": "2021-07-30T10:48:04.102Z"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
".monitoring-es-"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
{
"exists": {
"field": "node_stats"
}
}
]
}
},
"aggs": {
"metricAgg": {
"max": {
"field": "node_stats.jvm.mem.heap_used_percent"
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.metricAgg.value > params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 69
}
}
},
"metadata": {
"name": "monitoring-es-jvm-PERCENT",
"xpack": {
"type": "json"
}
},
"result": {
"execution_time": "2021-07-30T10:48:04.151Z",
"execution_duration": 304,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 8,
"failed": 0,
"successful": 8,
"skipped": 0
},
"hits": {
"hits": [],
"total": 275,
"max_score": null
},
"took": 302,
"timed_out": false,
"aggregations": {
"metricAgg": {
"value": 71
}
}
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
".monitoring-es-"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"timestamp": {
"gte": "2021-07-30T10:48:04.102Z||-5m",
"lte": "2021-07-30T10:48:04.102Z",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
{
"exists": {
"field": "node_stats"
}
}
]
}
},
"aggs": {
"metricAgg": {
"max": {
"field": "node_stats.jvm.mem.heap_used_percent"
}
}
}
}
}
}
},
"condition": {
"type": "script",
"status": "success",
"met": true
},
"transform": {
"type": "script",
"status": "success",
"payload": {
"result": 71
}
},
"actions": [
{
"id": "email_action",
"type": "email",
"status": "failure",
"transform": {
"type": "script",
"status": "failure",
"reason": "runtime error",
"error": {
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"^---- HERE"
],
"script": "['items': ctx.payload.hits.collect(hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"lang": "painless",
"position": {
"offset": 35,
"start": 35,
"end": 200
}
}
],
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"^---- HERE"
],
"script": "['items': ctx.payload.hits.collect(hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"lang": "painless",
"position": {
"offset": 35,
"start": 35,
"end": 200
},
"caused_by": {
"type": "null_pointer_exception",
"reason": "Cannot invoke "Object.getClass()" because "callArgs[0]" is null"
}
}
},
"reason": "Failed to transform payload"
}
]
},
"messages": 
}

Regards,
Alexander O

2

Your query uses "size": 0, which means there is no hits array being returned, as you explicitely asked to disable it.

Another potential problem may be using the transform, as this replaces the payload fully.

Hope this helps!

3

Dear Alexander,

How can I use the fields found in the index and use that information to send it by mail, since we need to know which node has consumed a certain percentage of memory. I have seen that the way to use the information found in the index (node, ip, address) is to make a transformation to be able to read that information later in the body of the email.

Is there any other way to use to read the index information and mail it and send it to another index?

Regards,
Alexander Cuadra

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.