Getting parse exception on a Watch that works in a previous version of elastic

Elastic Stack Kibana
1

Hi, im getting this error when I test my watch

parse_exception :
"reason" : "please wrap watch including field [trigger] inside a "watch" field"

the alerts are sended to microsoft teams
this is my watch:

PUT _watcher/watch/my_watch/_execute
{
    "trigger": {
        "schedule": {
            "interval": "5m"
        }
    },
    "input": {
        "search": {
            "request": {
                "body": {
                    "size": 0,
                    "query": {
                        "bool": {
                            "filter": {
                                "range": {
                                    "@timestamp": {
                                        "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                                        "lte": "{{ctx.trigger.scheduled_time}}",
                                        "format": "strict_date_optional_time||epoch_millis"
                                    }
                                }
                            }
                        }
                    }
                },
                "indices": [
                    "metrics-*"
                ]
            }
        }
    },
    "condition": {
        "script": {
            "source": "if (ctx.payload.hits.total <= params.threshold) { return true; } return false;",
            "params": {
                "threshold": 0
            }
        }
    },
    "transform": {
        "script": {
            "source": "HashMap result = new HashMap(); result.result = ctx.payload.hits.total; return result;",
            "lang": "painless",
            "params": {
                "threshold": 0
            }
        }
    },
    "actions": {
        "webhook_teams": {
            "webhook": {
                "scheme": "https",
                "host": "outlook.office.com",
                "port": 443,
                "method": "post",
                "path": "/webhook/...",
                "params": {},
                "headers": {
                    "Content-Type": "application/json"
                },
                "body": "{{#toJson}}ctx.payload{{/toJson}}"
            }
        }
    }
}

I have it working in another older version of elastic, 7.5.1.....in version 7.6 doesnt work

Any suggestions?

2

Hi @ElasticLiver!

If you are executing an existing watch you only need to include the watch id in the request.

POST _watcher/watch/my_watch/_execute

Alternatively, you can define a watch in the request body.

POST _watcher/watch/_execute
{
  "watch" : {
   {
    "trigger": {
        "schedule": {
            "interval": "5m"
        }
    },
    "input": {
        "search": {
            "request": {
                "body": {
                    "size": 0,
                    "query": {
                        "bool": {
                            "filter": {
                                "range": {
                                    "@timestamp": {
                                        "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                                        "lte": "{{ctx.trigger.scheduled_time}}",
                                        "format": "strict_date_optional_time||epoch_millis"
                                    }
                                }
                            }
                        }
                    }
                },
                "indices": [
                    "metrics-*"
                ]
            }
        }
    },
    "condition": {
        "script": {
            "source": "if (ctx.payload.hits.total <= params.threshold) { return true; } return false;",
            "params": {
                "threshold": 0
            }
        }
    },
    "transform": {
        "script": {
            "source": "HashMap result = new HashMap(); result.result = ctx.payload.hits.total; return result;",
            "lang": "painless",
            "params": {
                "threshold": 0
            }
        }
    },
    "actions": {
        "webhook_teams": {
            "webhook": {
                "scheme": "https",
                "host": "outlook.office.com",
                "port": 443,
                "method": "post",
                "path": "/webhook/...",
                "params": {},
                "headers": {
                    "Content-Type": "application/json"
                },
                "body": "{{#toJson}}ctx.payload{{/toJson}}"
            }
        }
    }
}
  }
}

For more information, please check out the docs: https://www.elastic.co/guide/en/elasticsearch/reference/7.5/watcher-api-execute-watch.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.