Elastic watcher - modify query result value before condition

Elastic Stack Elasticsearch
1

Hi.

Im trying to create a watcher to compare two query results. Here is my code (it works):

{
  "trigger": {
   "schedule": {
    "interval": "1m"
    }
 },
"input": {
  "chain": {
    "inputs": [
    {
      "first": {
        "search": {
          "request": {
            "search_type": "query_then_fetch",
            "indices": [
              "<my_index-{now/d}>"
            ],
            "rest_total_hits_as_int": true,
            "body": {
              "size": 0,
              "query": {
                "bool": {
                  "must": [
                            {
                      "range": {
                        "@timestamp": {
                          "gte": "now-2m",
                          "lt": "now-1m"
                        }
                      }
                    },
                    {
                      "match": {
                        "http_path": "my_path/mypath.aspx"
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    },
    {
      "second": {
        "search": {
          "request": {
            "search_type": "query_then_fetch",
            "indices": [
              "<my_index-{now/d}>"
            ],
            "rest_total_hits_as_int": true,
            "body": {
              "size": 0,
              "query": {
                "bool": {
                  "must": [
                    {
                      "range": {
                        "@timestamp": {
                          "gte": "now-1m",
                          "lt": "now"
                        }
                      }
                    },
                    {
                      "match": {
                        "http_path": "my_path/mypath.aspx"
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  ]
}
},
   "condition": {
      "compare": {
       "ctx.payload.first.hits.total": {
        "gt": "{{(ctx.payload.second.hits.total)}}"
  }
}
 },
"actions": {
     "log": {
     "logging": {
       "level": "info",
        "text": "First is greater than second"
  }
}
}
}

I need to calculate the 60% of ctx.payload.first.hits.total, then compare with ctx.payload.second.hits.total. How can i do that? I tried to do a transform, and also tried scripts with no success.

Thanks in advance!

Regards,

Víctor

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.