How do I use dayOfWeek in a Watcher condition script?

alerting

#1

Hi. I've been using Watcher for a little while, but I don't know much about Elasticsearch itself -- enough to construct the queries I've needed for my watches (many thanks to Steve Kearns for his help when I was getting started). I've done a lot of looking around and haven't been able to figure this out. I want my condition script to check the day of the week for a particular hit. The date is stored in a field whose definition is:

"dateTransaction" : {
"type" : "date",
"format" : "dateOptionalTime"
}

I found references online to doing things like this to include the day of the week in a query...

"script": "doc['@timestamp'].date.dayOfWeek == 7"

... and I tried to adapt that to get the day of the week from our dateTransaction field in the watch's condition script, but without success. The underlying problem seems to be that the condition script sees dateTransaction as a string rather than as a date. Is there a way to get the condition script to see it as a date, and if so, what's the syntax to get the day of the week from it?

Thanks a lot.


(Alexander Reelsen) #2

Heya,

I think what you found might refer to older versions. However, if you use groovy, you have full access to the joda time library and this makes it a breeze to write your own logic for this. Take this example, but make sure you check out the joda docs!

PUT /test/test/1
{
  "day": "Tuesday"
}

PUT /test/test/2
{
  "day": "Wednesday"
}

GET /test/test/_mapping

GET test/_search
{
  "query": {
    "bool": {
      "filter": {
        "script": {
          "script": "doc['day'].value == DateTime.now().dayOfWeek().getAsText(Locale.ROOT).toLowerCase(Locale.ROOT)"
        }
      }
    }
  }
}

Instead of DateTime.now(), you can also just pass the date of a field like new DateTime(doc['@timestamp'])

Hope this helps! On further questions, please provide a full example of what you did with watcher and conditions, so one can reproduce. Thx!

--Alex


#3

Alex, thanks so much. The DateTime class was the missing piece I needed. Much appreciated!


(system) #4