Ctx.payload.hits NOT working error

hey there, I´m trying to create a watcher but i need to use some fields from my index to send that information via email but i always get the same error

"caused_by": {
"type": "null_pointer_exception",
"reason": "Cannot invoke "Object.getClass()" because "callArgs[0]" is null"

This is my watcher

{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
".monitoring-es-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
{
"exists": {
"field": "node_stats"
}
}
]
}
},
"aggs": {
"metricAgg": {
"max": {
"field": "node_stats.jvm.mem.heap_used_percent"
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.metricAgg.value > params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 69
}
}
},
"actions": {
"email_action": {
"transform": {
"script": {
"source": "['items': ctx.payload.hits.collect(hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"lang": "painless"
}
},
"email": {
"profile": "standard",
"to": [
"ander.o@example.com"
],
"subject": "[{{ctx.metadata.name}}] node Heap: ({{ctx.payload.result}}%) > 85%",
"body": {
"html": """

Monitoring Cluster


The Alarm [{{ctx.metadata.name}}], detected excedeed 85% Heap usage of {{ctx.payload.result}} in the node {{NodeName}},










            <tr>
              <td>{{NodeName}}</td>
              <td>{{HostName}}</td>
              <td>{{Address}}<td>
              <td>{{ctx.payload.aggregations.metricAgg.value}}<td>
            </tr>          

        </table>
        <BR>
        <BR>
        """
    }
  }
}

},
"transform": {
"script": {
"source": "HashMap result = new HashMap(); result.result = ctx.payload.aggregations.metricAgg.value; return result;",
"lang": "painless",
"params": {
"threshold": 69
}
}
}
}

this is part of the index

"hits" : [
{
"_index" : ".monitoring",
"_type" : "_doc",
"_id" : "IUHjJKJKJGvuyvytyiuhiuhuiho",
"_score" : 0.0,
"_source" : {
"@timestamp" : "2020-06-30T06:44:22.897Z",
"type" : "node_stats",
"event" : {
"module" : "elasticsearch",
},
"service" : {
"address" : "xxxxxx",
"type" : "elasticsearch"
},
"agent" : {
"name" : "XXXX",
,
"timestamp" : "2020-06-30T06:44:22.904Z",
"source_node" : {
"transport_address" : "192.128.1.0.0.0",
"name" : "master"
},
"ecs" : {
"version" : "1.7.0"
},
"id" : "3a81894984917881189",
"name" : "xxxx",
"hostname" : "xxxxx",
},
"node_stats" : {
"process" : {
"cpu" : {
"percent" : 0
},
"node_master" : true,
"jvm" : {
"mem" : {
"heap_used_in_bytes" : 20273711512,
"heap_used_percent" : 60,
"heap_max_in_bytes" : 33285996544
}
and the error is alway about

"caused_by": {
"type": "null_pointer_exception",
"reason": "Cannot invoke "Object.getClass()" because "callArgs[0]" is null"
}
}
},
"reason": "Failed to transform payload"

here you have the error complete

{
"watch_id": "XXXXXXb",
"node": "XXXXX",
"state": "executed",
"user": "elastic",
"status": {
"state": {
"active": true,
"timestamp": "2021-07-30T10:46:25.268Z"
},
"last_checked": "2021-07-30T10:48:04.151Z",
"last_met_condition": "2021-07-30T10:48:04.151Z",
"actions": {
"email_action": {
"ack": {
"timestamp": "2020-07-30T10:46:25.268Z",
"state": "awaits_successful_execution"
},
"last_execution": {
"timestamp": "2021-07-30T10:48:04.151Z",
"successful": false,
"reason": "Failed to transform payload"
}
}
},
"execution_state": "executed",
"version": -1
},
"trigger_event": {
"type": "schedule",
"triggered_time": "2021-07-30T10:48:04.151Z",
"schedule": {
"scheduled_time": "2021-07-30T10:48:04.102Z"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
".monitoring-es-"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
{
"exists": {
"field": "node_stats"
}
}
]
}
},
"aggs": {
"metricAgg": {
"max": {
"field": "node_stats.jvm.mem.heap_used_percent"
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.metricAgg.value > params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 69
}
}
},
"metadata": {
"name": "monitoring-es-jvm-PERCENT",
"xpack": {
"type": "json"
}
},
"result": {
"execution_time": "2021-07-30T10:48:04.151Z",
"execution_duration": 304,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 8,
"failed": 0,
"successful": 8,
"skipped": 0
},
"hits": {
"hits": [],
"total": 275,
"max_score": null
},
"took": 302,
"timed_out": false,
"aggregations": {
"metricAgg": {
"value": 71
}
}
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
".monitoring-es-
"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"timestamp": {
"gte": "2021-07-30T10:48:04.102Z||-5m",
"lte": "2021-07-30T10:48:04.102Z",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
{
"exists": {
"field": "node_stats"
}
}
]
}
},
"aggs": {
"metricAgg": {
"max": {
"field": "node_stats.jvm.mem.heap_used_percent"
}
}
}
}
}
}
},
"condition": {
"type": "script",
"status": "success",
"met": true
},
"transform": {
"type": "script",
"status": "success",
"payload": {
"result": 71
}
},
"actions": [
{
"id": "email_action",
"type": "email",
"status": "failure",
"transform": {
"type": "script",
"status": "failure",
"reason": "runtime error",
"error": {
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"^---- HERE"
],
"script": "['items': ctx.payload.hits.collect(hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"lang": "painless",
"position": {
"offset": 35,
"start": 35,
"end": 200
}
}
],
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"^---- HERE"
],
"script": "['items': ctx.payload.hits.collect(hit -> ['HostName': hit._source.service.address, 'NodeName': hit._source.agent.hostname, 'Address': hit._source.source_code.transport_address, 'index': hit._index])]",
"lang": "painless",
"position": {
"offset": 35,
"start": 35,
"end": 200
},
"caused_by": {
"type": "null_pointer_exception",
"reason": "Cannot invoke "Object.getClass()" because "callArgs[0]" is null"
}
}
},
"reason": "Failed to transform payload"
}
]
},
"messages":
}

Node Host Name IP %

Welcome to our community! :smiley:

For future reference you can edit topics/posts and update formatting, it saves creating duplicate topics. Let's continue the discussion at Ctx.payload.hits NOT working error (Good format)