Elasticsearch watcher transform script


(Santhoshkumar) #1

How to pass the payload as input to 'transform' process in ELK watcher? I have tried with following way but it pass them as string to groovy file.

"transform": {
   "script": {
     "file": "error_parser",
     "lang": "groovy",
     "params": {
       "inputval": "{{ctx.payload.aggregations.errorcount.buckets}}"

When I wanted to pass a string or integer, I face no issues, but with objects. Is there a way to pass them to file? And in this case, where do the output value that we return from groovy script stored (The 'condition' process evaluates the output to boolean in similar case)?

Groovy content:

println inputval
return inputval[0].doc_count

I get following error when I execute the watcher

[2016-03-22 17:23:08,637][ERROR][watcher.transform.script ] [Hannah Levy] failed to execute [script] transform for [my-watch_2-2016-03-22T21:23:08.617
ScriptException[failed to run file script [error_parser] using lang [groovy]]; nested: MissingPropertyException[No such property: doc_count for class:
        at org.elasticsearch.script.groovy.GroovyScriptEngineService$GroovyScript.run(GroovyScriptEngineService.java:318)
        at org.elasticsearch.watcher.transform.script.ExecutableScriptTransform.doExecute(ExecutableScriptTransform.java:73)
        at org.elasticsearch.watcher.transform.script.ExecutableScriptTransform.execute(ExecutableScriptTransform.java:59)
        at org.elasticsearch.watcher.transform.script.ExecutableScriptTransform.execute(ExecutableScriptTransform.java:40)

(Alexander Reelsen) #2


you are trying to do two things at once here, first replacing a string and then evaluating it, which is not supported.

I dont know on top of my head if there is any smart way to do this in groovy like specifying via a dynamic constructed path ala x['a.b.c'] (this does not work!), maybe some groovy expert can chime in here.


(system) #3