Elastic wacher painlless script and mustache template

hi

I have created following watcher by following https://cinhtau.net/2017/06/19/es-nodes-mem_watch/ I had to edit few stuff to make it work for ELK 7

{
  "trigger": {
    "schedule": {
      "interval": "6h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          ".monitoring-es-7*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "timestamp": {
                      "gte": "now-2m",
                      "lte": "now"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "minutes": {
              "date_histogram": {
                "field": "timestamp",
                "calendar_interval": "1h"
              },
              "aggs": {
                "nodes": {
                  "terms": {
                    "field": "source_node.name"
                  },
                  "aggs": {
                    "memory": {
                      "max": {
                        "field": "node_stats.jvm.mem.heap_used_percent"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.minutes.buckets.stream().anyMatch(b -> b.nodes.buckets.stream().anyMatch(x -> x.memory.value > 50))",
      "lang": "painless"
    }
  },
  "actions": {
    "send_mem_warning": {
      "transform": {
        "script": {
          "source": "def latest = ctx.payload.aggregations.minutes.buckets[-1]; return latest.nodes.buckets.stream().filter(item -> item.memory.value >= ctx.metadata.threshold).collect(Collectors.toList());",
          "lang": "painless"
        }
      },
      "email": {
        "profile": "standard",
        "from": "XXXXXXXXX",
        "reply_to": [
          "XXXXXXXX"
        ],
        "to": [
          "XXXXXXXXXX"
        ],
        "subject": "Watcher Notification - HIGH MEMORY USAGE",
        "body": {
          "html": {
            "id": "mem-watch-warning"
          }
        }
      }
    }
  },
  "metadata": {
    "threshold": 50
  }
}

I added mustache template as per that doc. When i execute the watcher i get following output (from log)

 "email" : {
            "account" : "exchange_account",
            "message" : {
              "id" : "send_mem_warning_mem-watch-mustache_1c138b80-c812-46ec-b6c0-449aa6536765-2020-02-25T03:00:53.683535Z",
              "from" : "XXXXXXXXXXXXXX",
              "reply_to" : [
                "XXXXXXXXX"
              ],
              "sent_date" : "2020-02-25T03:00:54.338305Z",
              "to" : [
                "XXXXXXXXX"
              ],
              "subject" : "Watcher Notification - HIGH MEMORY USAGE",
              "body" : {
                "html" : "mem-watch-warning"
              }
            }
          }
        }

my email has only following.

mem-watch-warning

So some where in forum i read painelss and mustache dont work together. But i lost that thread. So is that true ? if yes how do i fix my issue ?

any input ?

Can you explain what you mean with 'do not work together' - it's basically an either-or relationship. Either you use a painless script, for example for the script condition, or you use mustache, if you want to format text, but not both.

Hope that makes sense, otherwise please add somemore detail to your question, what you are referring to.

Thanks!

Alexander,

I ended up opening a case and i was told this is a known bug.

Raj

I just opened a PR to fix this, let's see if it gets in, you can follow it at https://github.com/elastic/elasticsearch/pull/53497

just curious how will i know this is fixed and released in what version ?

i found it.

spinscale added the v7.6.2 label 2 days ago