Help with dynamic filename in Watch URL

Elastic Stack Elasticsearch
1

I browsed a few topics but couldn't find a similar example. I basically want a Watch set up, searches for keyword and emails (as attachment) any files it finds with that keyword. It works if I hardcode the filename in the URL (ie Attachment.pdf), if I try and use mustache templating it errors at Watch creation time with "results in error "Malformed URL [{{ctx.payload.hits.hits.0._source.filename}}]""

If I try and use just ctx.payload.hits.hits.0._source.filename without the brackets, then it sends that literal text to my webserver, which of course doesn't know what ctx.payload.hits....filename is and my webserver errors.

"trigger" : {
   "schedule" : {
      "interval": "12h"
   }
 },
 "input" : {
   "search" : {
     "request" : {
       "body" : {
         "query": {
            "match": { 
               "_all" : "keyword" 
             }
          }
       }
     }
   }
 },
 "condition" : {
   "compare" : { 
     "ctx.payload.hits.total" : { 
       "gt" : 0 
     }
   }
 },
 "actions" : {
   "email_admin" : {
     "email" : {
       "to" : "me@company.com",
       "subject" : "Keyword found!",
       "attachments" : {
         "heaven.pdf" : { 
           "http" : { 
           "content_type" : "application/pdf",
             "request" : {
               "url": "http://localhost:8000/{{ctx.payload.hits.hits.0._source.filename}}"
             }
           }
         }
       }
     }
   }
 }

A sample response from my keyword search

                "file": {
                    "extension": "pdf",
                    "content_type": "application/pdf",
                    "last_modified": "2017-09-05T11:30:51.605+0000",
                    "indexing_date": "2017-09-12T17:01:22.214+0000",
                    "filesize": 93745,
                    "filename": "7-19-17 CC - Linn Ann Jones Griffin.pdf",
                    "url": "file://c:\\express\\agendakeyword\\BoardDocs\\7-19-17 CC - Linn Ann Jones Griffin.pdf"
                },
                "path": {
                    "root": "7511c68c2ea637f9d0867848d06b7d55",
                    "virtual": "/7-19-17 CC - Linn Ann Jones Griffin.pdf",
                    "real": "c:\\express\\agendakeyword\\BoardDocs\\7-19-17 CC - Linn Ann Jones Griffin.pdf"
                }
            }

I don't understand why I'm getting a malformed error. Thanks

2

Apparently the URL field doesn't allow for templating? I switched to this and now it works.

 "http" : { 
        "content_type" : "text/plain",
        "request" : {
          "host": "localhost",
          "port": 8000,
          "path": "/{{ctx.payload.hits.hits.0._source.file.filename}}"
        }
      }
    }
3

My next question is, is the watcher robust enough to perform a search, then send an email with each attachment (with the attachment filename being dynamically generated). If so, are there any examples of this?

It seems a middle-ware piece would need to be developed, have the watcher setup as webhook that calls another service that then parses the payload and sends out an email. Although I'd like to avoid unnecessary middle-ware pieces. Thanks

"input" : {
  "search" : {
    "request" : {
      "body" : {
        "query": {
           "match": { 
              "_all" : "keyword" 
            }
         }
      }
    }
  }
},
4

can you please start including the full watch, and the output of the execute watch API of that watch as well. All those loose snippets make it hard to follow.

Thank you!

--Alex

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.