Date math index name throwing error in Watcher input

I've the date math name in one of the watcher search input as below.

"indices": ["<.watcher-history-13-{now/d}>"]

But the execution fails with below error.

"result": {
    "execution_time": "2021-12-01T07:57:46.049Z",
    "execution_duration": 1732,
    "input": {
      "type": "chain",
      "status": "failure",
      "error": {
        "root_cause": [
          {
            "type": "null_pointer_exception",
            "reason": "Cannot invoke \"org.elasticsearch.xpack.core.watcher.watch.Payload.data()\" because the return value of \"org.elasticsearch.xpack.core.watcher.input.Input$Result.payload()\" is null"
          }
        ],
        "type": "null_pointer_exception",
        "reason": "Cannot invoke \"org.elasticsearch.xpack.core.watcher.watch.Payload.data()\" because the return value of \"org.elasticsearch.xpack.core.watcher.input.Input$Result.payload()\" is null"
      },
      "chain": {}
    },
    "actions": []
  }

Same search works well from the console. Also, if I change the number 13 to something else(i.e., non existent index) search completes without any error.

What could be the issue here?

which version are you trying this against? As the 13 is an internal implementation detail and might change after an upgrade, using this is probably not a good idea... any chance of just querying the full history indices and write a query using a timestamp? Or isn't that an option?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.