Ctx.trigger.triggered_time math and formatting

Elastic Stack Kibana
,
1

I have a Watcher that filters on a timestamp range. I'd like to capture the searched timestamp range by saving something like "Start": "ctx.trigger.triggered_time - 23m" and "End": "ctx.trigger.triggered_time - 22m" into a variable so I can then use that start and end time in an alert message. I'd also like to make sure the times are in my current timezone.

I've been reading a bit on Watch script payload transforms but I'm not sure where in the Watcher to do this or how to properly do the math. I'd really appreciate some help.

2

take a look at this example:

1 Like
3

@richcollier thank you that is helpful. I THINK I have adapted that to exactly what I need, but the Watcher UI is complaining about the action with error "Unknown action type provided for action "my-logging-action"." Is there a prerequisite I need to do before this will work?

4

Watcher actions can be only of the following type:

However, they can be named anything. You can see in my example, the type is logging but the name is my-logging-action. There, of course, is also a transform in there as well.

Check your code to make sure your syntax is correct. Or, try your Watch in DevTools console to make sure the Watcher UI isn't the problem.

6

I tried running it through the Dev tool but get this:

{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "could not parse action [_inlined_/my-logging-action]. unknown action type [send_email]"
      }
    ],
    "type": "parse_exception",
    "reason": "could not parse action [_inlined_/my-logging-action]. unknown action type [send_email]"
  },
  "status": 400
}
7

Just post your actions section here for review

8

Thank you.

"actions": {
      "my-logging-action": {
        "transform": {
          "script": """
          def payload = ctx.payload; 
          DateFormat df = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"); 
          ctx.payload.from = df.format(Date.from(Instant.ofEpochMilli(ctx.execution_time.getMillis() - (23*60*1000) )));
          ctx.payload.to = df.format(Date.from(Instant.ofEpochMilli(ctx.execution_time.getMillis()  - (22*60*1000) )));
          return payload
          """
        },
        "send_email": {
          "throttle_period_in_millis": 1200000,
          "email": {
            "profile": "standard",
            "to": [
              "alerts@mycompany.org"
            ],
            "subject": "Alert - Transaction Count Too Low",
            "body": {
              "text": "Expected minium is 7 transactions, but {{ctx.payload.hits.total}} were found between {{ctx.payload.from}} and {{ctx.payload.to}}."
            }
          }
        }
      }
    }
9

it should look like this:

    "actions": {
      "send_email": {
        "throttle_period_in_millis": 1200000,
        "transform": {
          "script": """
          def payload = ctx.payload; 
          DateFormat df = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"); 
          ctx.payload.from = df.format(Date.from(Instant.ofEpochMilli(ctx.execution_time.getMillis() - (23*60*1000) )));
          ctx.payload.to = df.format(Date.from(Instant.ofEpochMilli(ctx.execution_time.getMillis()  - (22*60*1000) )));
          return payload
          """
        },
        "email": {
          "profile": "standard",
          "to": [
            "alerts@mycompany.org"
          ],
          "subject": "Alert - Transaction Count Too Low",
          "body": {
            "text": "Expected minium is 7 transactions, but {{ctx.payload.hits.total}} were found between {{ctx.payload.from}} and {{ctx.payload.to}}."
          }
        }
      }
    }
1 Like
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.