Date math index name throwing error in Watcher input

Elastic Stack Elasticsearch
1

I've the date math name in one of the watcher search input as below.

"indices": ["<.watcher-history-13-{now/d}>"]

But the execution fails with below error.

"result": {
    "execution_time": "2021-12-01T07:57:46.049Z",
    "execution_duration": 1732,
    "input": {
      "type": "chain",
      "status": "failure",
      "error": {
        "root_cause": [
          {
            "type": "null_pointer_exception",
            "reason": "Cannot invoke \"org.elasticsearch.xpack.core.watcher.watch.Payload.data()\" because the return value of \"org.elasticsearch.xpack.core.watcher.input.Input$Result.payload()\" is null"
          }
        ],
        "type": "null_pointer_exception",
        "reason": "Cannot invoke \"org.elasticsearch.xpack.core.watcher.watch.Payload.data()\" because the return value of \"org.elasticsearch.xpack.core.watcher.input.Input$Result.payload()\" is null"
      },
      "chain": {}
    },
    "actions": []
  }

Same search works well from the console. Also, if I change the number 13 to something else(i.e., non existent index) search completes without any error.

What could be the issue here?

2

which version are you trying this against? As the 13 is an internal implementation detail and might change after an upgrade, using this is probably not a good idea... any chance of just querying the full history indices and write a query using a timestamp? Or isn't that an option?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.