Help with Watcher Script Transform

Elastic Stack Kibana
1

I am trying to pass some data from a watcher to another index. I was looking to use the Script Transform with Index Action to insert data from the watch. With this code, I'm getting a "could not parse action [inlined/transform]. unknown action type [script]" error.

Any ideas?

   "actions": {
      "transform" : {
         "script" : {
            "inline" : "return ['@timestamp':ctx.triggered_time]", 
            "lang" : "painless"
         }
      },
      "index" : {
         "index" : "alerts-*",
         "doc_type" : "doc"
          }
        }
2

@Alexander_Reelsen - an you please help here ?

Thanks
Rashmi

3

Here is the full code if it helps.

POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "1m"
      }
    },
    "input": {
      "search": {
        "request": {
          "indices" : [
            "winlogs-*"
            ],
          "body": {
            "size": 3,
            "query": {
              "bool": {
                "must" : [{
                  "match" : {
                     "event_id" : "4624" 
                     }
                  }, {
                  "range" : {
                     "@timestamp" : {
                        "gte" : "now-1h" 
                     }
                   }
                }]
                }
               },
               "aggs" : {
                 "workstation" : {
                   "terms": {
                     "field" : "event_data.WorkstationName"
                 }
                  }
                 }
               }
             }
          }
        },
        "condition" : {
          "compare" : {
            "ctx.payload.aggregations.workstation.buckets.0.doc_count" : {"gt" : 6}
          }
        },
       "actions": {
          "transform" : {
             "script" : {
                "inline" : "return ['@timestamp':ctx.triggered_time]", 
                "lang" : "painless"
             }
          },
          "index" : {
             "index" : "alerts-*",
             "doc_type" : "doc"
              }
            }
          }
      }
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.