Foreach for bucket aggregation in watcher not working

Elastic Stack Elasticsearch
1

Hi ,

I am trying to logging according to user using foreach but it is giving exception

"type" : "exception",
"reason" : "specified foreach object was null: [ctx.payload.aggregations.user.buckets.keys]"
}

Foreach Condition
"foreach" : "ctx.payload.aggregations.user.buckets.keys",
"logging":{
"text":" {{#ctx.payload.aggregations.user.buckets}}{{key}} {{/ctx.payload.aggregations.user.buckets}} "
}
}

Aggregation Result
"aggregations" : {
"user" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"doc_count" : 6,
"instance" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"doc_count" : 6,
"remoteadd" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"doc_count" : 4,
"objects" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"doc_count" : 1,
"key" : "abc"
},
{
"doc_count" : 1,
"key" : "abc/abc"
},
{
"doc_count" : 1,
"key" : "abc/abc-mirror"
},
{
"doc_count" : 1,
"key" : "abc/abc-android"
}
]
},
"key" : "10.202.334.43"
},
{
"doc_count" : 2,
"objects" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"doc_count" : 2,
"key" : "abc/abc-main"
}
]
},
"key" : "54.45.543.23"
}
]
},
"key" : "server1.domain.com"
}
]
},
"key" : "pritib"
}
]
}
}
},
In aggregation result currently have only one user "pritib", but in future we may get more number of user .
Please help.
Thanks in advance.

2

I think you should use key instead of keys

ctx.payload.aggregations.user.buckets
3

I tried with ctx.payload.aggregations.user.buckets.key also but it is not working.
Actually I have to take ctx.payload.aggregations.user.buckets.key in email action and sent email to respective key [user with there details for that i have to use foreach]

4

This is your buckets array : ctx.payload.aggregations.user.buckets ? It should be used with foreach simply

5

yes. When I have used

"log":{
"foreach" : "ctx.payload.aggregations.user.buckets",
"logging":{
"text":" {{#ctx.payload.aggregations.user.buckets}}{{key}} {{/ctx.payload.aggregations.user.buckets}} "
}
}

It is giving below error ,
"actions" : [
{
"id" : "log",
"type" : "logging",
"status" : "failure",
"error" : {
"root_cause" : [
{
"type" : "exception",
"reason" : "specified foreach object was null: [ctx.payload.aggregations.user.buckets]"
}
],
"type" : "exception",
"reason" : "specified foreach object was null: [ctx.payload.aggregations.user.buckets]"
}
},

6

Can you share your full watcher ?

7 
  "trigger": {
    "schedule": {
      "cron": "0 0/60 *  ? * *"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "log-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 1000,
          "query": {
            "bool": {
              "must": [
                {
                  "exists": {
                    "field": "current_user_"
                  }
                }
              ],
              "should": [
                {
                  "match": {
                    "program": "XYZ"
                  }
                }
              ],
              "must_not": [
                {
                  "match": {
                    "current_user_": "nil"
                  }
                }
              ],
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-4d",
                    "lte": "now"
                  }
                }
              }
            }
          },
          "aggs": {
            "user": {
              "terms": {
                "field": "current_user_.keyword",
                "min_doc_count": 25
              },
              "aggs": {
                "instance": {
                  "terms": {
                    "field": "instance_.keyword"
                  },
                  "aggs": {
                    "remoteadd": {
                      "terms": {
                        "field": "remote_address_.keyword"
                      },
                      "aggs": {
                        "repo": {
                          "terms": {
                            "field": "repo.keyword"
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 25
      }
    }
  },
  "actions": {
    "send_email": {
	  "foreach" : "ctx.payload.aggregations.user.buckets", 
      "max_iterations" : 500,
      "email": {
        "profile": "standard",
        "priority": "normal",
        "to": [
          "{{ctx.payload.aggregations.user.buckets}}{{key}}@domainname.com{{#ctx.payload.aggregations.user.buckets}}"
        ],
        "subject": "Subject XXXXXX",
        "body": {
          "html": "<p>Dear {{ctx.payload.aggregations.user.buckets}}{{key}}{{#ctx.payload.aggregations.user.buckets}}, <br><br> Please find below details<table border='1'><tr><th>User</th><th>Blocked transaction count</th><th>Instance</th><th>Remote Address</th><th>Repo</th></tr> {{#ctx.payload.aggregations.user.buckets}} <tr><td> {{key}} </td><td> {{doc_count}} </td>{{#instance.buckets}}<td> <p>{{key}} {{/instance.buckets}} </p></td><td>{{#instance.buckets}}{{#remoteadd.buckets}} <p>{{key}} {{/remoteadd.buckets}}{{/instance.buckets}}<br><br></p></td><td>{{#instance.buckets}}{{#remoteadd.buckets}}{{#repo.buckets}}     <p>{{key}} {{/repo.buckets}}{{/remoteadd.buckets}}{{/instance.buckets}}<br><br></p></div></td></tr>{{/ctx.payload.aggregations.user.buckets}} </table><p><p>Regards<br>Application Monitoring Team</p>"
        }
      }
    },
    "log": {
	"foreach" : "ctx.payload.aggregations.user.buckets", 
      "max_iterations" : 500,
      "logging": {
        "level": "info",
        "text": " <table border='1'><tr><th>User</th><th>Blocked transaction count</th><th>Instance</th><th>Remote Address</th><th>Repo</th></tr> {{#ctx.payload.aggregations.user.buckets}} <tr><td> {{key}}@<domainname>.com </td><td> {{doc_count}} </td>{{#instance.buckets}}<td> <p>{{key}} {{/instance.buckets}} </p></td><td>{{#instance.buckets}}{{#remoteadd.buckets}} <p>{{key}} {{/remoteadd.buckets}}{{/instance.buckets}}<br><br></p></td><td>{{#instance.buckets}}{{#remoteadd.buckets}}{{#repo.buckets}}     <p>{{key}} {{/repo.buckets}}{{/remoteadd.buckets}}{{/instance.buckets}}<br><br></p></div></td></tr>{{/ctx.payload.aggregations.user.buckets}} "
      }
    }
  }
}```
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.