Error saving watch [1:234] [script] unknown field [query]

Elastic Stack Elasticsearch
1

{
"trigger": {
"schedule": {
"interval": "10s"
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"http": {
"request": {
"scheme": "https",
"host": "",
"port": ,
"method": "get",
"path": "llm_full_address/_count",
"body" : {
"query": {
"range": {
"timestamp":{
"gte": "now-1d/d",
"lt": "now/d"
}
}
}
},
"params": {},
"headers": {},
"auth": {
"basic": {
"username": "",
"password": ""
}
}
}
}
}
},
{
"second": {
"http": {
"request": {
"scheme": "https",
"host": "",
"port": ,
"method": "get",
"path": "llm_keyahead_address/_count",
"body" : {
"query": {
"range": {
"timestamp":{
"gte": "now-1d/d",
"lt": "now/d"
}
}
}
},
"params": {},
"headers": {},
"auth": {
"basic": {
"username": "",
"password": ""
}
}
}
}
}
},
{
"third": {
"http": {
"request": {
"scheme": "https",
"host": "seaselk-dev-elastic.corp.chartercom.com",
"port": 443,
"method": "get",
"params": {},
"headers": {},
"auth": {
"basic": {
"username": "",
"password": ""
}
}
}
}
}
}
]
}
},
"condition": {
"always": {}
},
"actions": {
"send_full_address_email": {
"condition": {
"compare": {
"ctx.payload.first.count": {
"eq": 0
}
}
},
"email": {
"profile": "standard",
"from": "",
"to": [
""
],
"subject": "Data Unavailability in llm_full_address_index",
"body": {
"text": "Index Count is {{ctx.payload.first.count}}, Please Validate the Index"
}
}
},
"send_keyahead_address_email": {
"condition": {
"compare": {
"ctx.payload.second.count": {
"eq": 0
}
}
},
"email": {
"profile": "standard",
"from": "*************",
"to": [
""
],
"subject": "Data Unavailability in llm_keyahead_address_index",
"body": {
"text": "Index Count is {{ctx.payload.second.count}}, Please Validate the Index."
}
}
},
"send_status_code_email": {
"condition": {
"compare": {
"ctx.payload.third._status_code": {
"not_eq": 200
}
}
},
"email": {
"profile": "standard",
"from": "",
"to": [
"*"
],
"subject": "Status Code Alert",
"body": {
"text": "Status code is not 200, Please check credentials."
}
}
}
}
}
Actually I need trigger alert when the count is 0 in the 1day time range, But I am unable to create it.
The problem is in
"body" : {
"query": {
"range": {
"timestamp":{
"gte": "now-1d/d",
"lt": "now/d"
}
}
}
}
By adding this query its showing error, So please help me to solve this

2

The value of the body needs to be an escaped string. A JSON string as the value. Watcher HTTP input | Elasticsearch Guide [8.0] | Elastic has an example, and Kibana dev tools support triple quotes "body": """{ to help with escaping. The script part of the error is likely due to the JSON parser interpreting the value as a mustache template.

3

Thank you, This solved my problem...

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.