Ctx.payload object data disappearing after inclusion of script_field in watcher api

Elastic Stack Elasticsearch
1

Hello,

I'm having an issue where the data in my ctx.payload object is disappearing after I include "script_field" in my watcher. The watcher executes perfectly fine with the desired output when the "script_field" field is not included. Any thoughts on why this is happening?

Here is my code with the script_field:

{
  "trigger": {
    "schedule": {
      "cron": "0 0/1 * * * ?"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "my_index-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "stack trace",
                    "default_operator": "AND"
                  }
                }
              ],
              "filter": {
                "range": {
                  "@timestamp": {
                    "from": "{{ctx.trigger.scheduled_time}}||-15m",
                    "to": "{{ctx.trigger.triggered_time}}"
                  }
                }
              }
            }
          },
          "script_fields": {
            "field_name": {
                "script": {
                    "lang": "painless",
                    "source": "doc['hostname.keyword'].value.substring(7,10)"
                }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "actions": {
    "email_admin": {
      "throttle_period_in_millis": 900000,
      "email": {
        "profile": "standard",
        "to": [
          "first last <first.last@domain.com>"
        ],
        "subject": "Stack Trace Error(s): {{#ctx.payload.hits.hits}} {{fields.field_name.0}} {{/ctx.payload.hits.hits}}",
        "body": {
          "html": """ <html>
          
          Hello,
          <br />
          <br />
          There are stack trace errors in the following hosts:
          <br />
          <br />
          {{#ctx.payload.hits.hits}} 
          <strong> Host: </strong> {{_source.hostname}} <br />
          <hr /> <br />
          {{/ctx.payload.hits.hits}}
          
          </html>
          """
        }
      }
    }
  }
}

The html just outputs "Host: " however when the script_field is removed it outputs the hostname properly. Any help would be greatly appreciated. Thanks in advance.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.