Elasticsearch watch cannot push alarm emails

>    {
>   "trigger": {
>     "schedule": {
>       "interval": "30m"
>     }
>   },
>   "input": {
>     "search": {
>       "request": {
>         "search_type": "query_then_fetch",
>         "indices": [
>           "apm-7.6.2-transaction-000001"
>         ],
>         "rest_total_hits_as_int": true,
>         "body": {
>           "size": 0,
>           "query": {
>             "bool": {
>               "filter": [
>                 {
>                   "range": {
>                     "@timestamp": {
>                       "from": "now-30m",
>                       "to": "now"
>                     }
>                   }
>                 },
>                 {
>                   "term": {
>                     "transaction.custom.responseStatus": "200"
>                   }
>                 },
>                 {
>                   "term": {
>                     "service.name": "IMS-4-199"
>                   }
>                 }
>               ]
>             }
>           }
>         }
>       }
>     }
>   },
>   "condition": {
>     "compare": {
>       "ctx.payload.hits.total.value": {
>         "gt": 0
>       }
>     }
>   },
>   "actions": {
>     "email_administrator": {
>       "email": {
>         "profile": "standard",
>         "to": [
>           "wajika@gmail.com"
>         ],
>         "subject": " xxx {{ctx.payload.hits.total}} ",
>         "body": {
>           "text": "xxxxxx"
>         }
>       }
>     }
>   },
>   "metadata": {
>     "color": "red"
>   }
> }


> {
>   "watch_id": "log_count",
>   "node": "7A_YAlT2RKqYmspXkEJS1w",
>   "state": "execution_not_needed",
>   "user": "elastic",
>   "status": {
>     "state": {
>       "active": true,
>       "timestamp": "2020-05-05T01:11:14.659Z"
>     },
>     "last_checked": "2020-05-05T01:14:24.010Z",
>     "actions": {
>       "email_administrator": {
>         "ack": {
>           "timestamp": "2020-05-05T01:11:14.659Z",
>           "state": "awaits_successful_execution"
>         }
>       }
>     },
>     "execution_state": "execution_not_needed",
>     "version": -1
>   },
>   "trigger_event": {
>     "type": "schedule",
>     "triggered_time": "2020-05-05T01:14:24.010Z",
>     "schedule": {
>       "scheduled_time": "2020-05-05T01:14:23.866Z"
>     }
>   },
>   "input": {
>     "search": {
>       "request": {
>         "search_type": "query_then_fetch",
>         "indices": [
>           "apm-7.6.2-transaction-000001"
>         ],
>         "rest_total_hits_as_int": true,
>         "body": {
>           "size": 0,
>           "query": {
>             "bool": {
>               "filter": [
>                 {
>                   "range": {
>                     "@timestamp": {
>                       "from": "now-30m",
>                       "to": "now"
>                     }
>                   }
>                 },
>                 {
>                   "term": {
>                     "transaction.custom.responseStatus": "200"
>                   }
>                 },
>                 {
>                   "term": {
>                     "service.name": "IMS-4-199"
>                   }
>                 }
>               ]
>             }
>           }
>         }
>       }
>     }
>   },
>   "condition": {
>     "compare": {
>       "ctx.payload.hits.total.value": {
>         "gt": 0
>       }
>     }
>   },
>   "metadata": {
>     "color": "red",
>     "xpack": {
>       "type": "json"
>     }
>   },
>   "result": {
>     "execution_time": "2020-05-05T01:14:24.010Z",
>     "execution_duration": 1,
>     "input": {
>       "type": "search",
>       "status": "success",
>       "payload": {
>         "_shards": {
>           "total": 1,
>           "failed": 0,
>           "successful": 1,
>           "skipped": 0
>         },
>         "hits": {
>           "hits": [],
>           "total": 11,
>           "max_score": null
>         },
>         "took": 0,
>         "timed_out": false
>       },
>       "search": {
>         "request": {
>           "search_type": "query_then_fetch",
>           "indices": [
>             "apm-7.6.2-transaction-000001"
>           ],
>           "rest_total_hits_as_int": true,
>           "body": {
>             "size": 0,
>             "query": {
>               "bool": {
>                 "filter": [
>                   {
>                     "range": {
>                       "@timestamp": {
>                         "from": "now-30m",
>                         "to": "now"
>                       }
>                     }
>                   },
>                   {
>                     "term": {
>                       "transaction.custom.responseStatus": "200"
>                     }
>                   },
>                   {
>                     "term": {
>                       "service.name": "IMS-4-199"
>                     }
>                   }
>                 ]
>               }
>             }
>           }
>         }
>       }
>     },
>     "condition": {
>       "type": "compare",
>       "status": "success",
>       "met": false,
>       "compare": {
>         "resolved_values": {
>           "ctx.payload.hits.total.value": null
>         }
>       }
>     },
>     "actions": []
>   },
>   "messages": []
> }

why "ctx.payload.hits.total: null" ?

Should be condition.compare.ctx.payload.hits.total
instead of condition.compare.ctx.payload.hits.total.value

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.