How put 2 scripts in a watcher

Elastic Stack Elasticsearch
,
1

hello how can i put 2 scripts in an alert? i have one that is from "ctx.payload.time_triggered" and the other is for "metric.agg". i need help with this...

{
  "trigger": {
    "schedule": {
      "interval": "1h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "agenteallot*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                      "lte": "{{ctx.trigger.scheduled_time}}",
                      "format": "strict_date_optional_time||basic_time_no_millis"
                    }
                  }
                },
                {
                  "term": {
                    "monitor.name.keyword": "01-2-CAV3000006278-DATOS-BKP-2.7G-99.98"
                  }
                }
              ]
            }
          },
          "aggs": {
            "metricAgg": {
              "max": {
                "field": "summary.up"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.aggregations.metricAgg.value >= params.threshold) { return true; } return false;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "json"
        },
        "to": [
          "juan.jaramillo@megadvantage.com",
          "juancho.jaramillo16@gmail.com",
          "jose.caceresg@etb.com.co",
          "victor.vera@megadvantage.com"
        ],
        "subject": "{{ctx.metadata.name}} 01-2-CAV3000006278-DATOS-BKP-2.7G-99.98",
        "body": {
          "text": """Buen dia, Adjunto registro del reporte.

 ⚠️ALERTA NODO!!! El siguiente enlace perdió la conexión. 

 Estado: Down🔴 

 Nombre del Enlace: 01-2-CAV3000006278-DATOS-BKP-2.7G-99.98

 🕧Hora: {{ctx.payload.time_triggered}}  {{ctx.result.execution_time}}

 Área: Networking 

 🔔Mensaje Alerta: El enlace ha dejado de responder. Responder correo a telecomunicaciones@udistrital.edu.co 

 Ingrese aquí para más información: https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/uptime#"""
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "return [ 'time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss')) ]",
      
      "lang": "painless",
       "script": {
      "source": "HashMap result = new HashMap(); result.result = ctx.payload.aggregations.metricAgg.value; return result;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
      }
    }
    }
  }
}

ERROR Simulation output...

Screenshot 2020-10-16 082427
Screenshot 2020-10-16 082427951×591 10.2 KB

2

Take a look at the chain transform or merge the two scripts into one.

3

How do I do that? sorry men

4

It doesn't work that way.

 "transform": {
      "chain": [
  {
    "script": {
      "source": "return [ 'time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss')) ]",
      
      "lang": "painless",
       "script": {
      "source": "HashMap result = new HashMap(); result.result = ctx.payload.aggregations.metricAgg.value; return result;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
}
}
}
}
]
}
}

error:

[x_content_parse_exception] [1:1817] [script] unknown field [script]
5

Please take your time read the documentation again. Just copy pasting your previous code will not work. Take your time to understand the JSON structure of a chained transform instead of trying to make everything work by copy paste.

If the docs are hard to understand, we have to fix the docs, but I get the feeling you are using this forum to dump all your questions and expect ready-made answers that you can actually copy & paste. This is not how this forum works. It's about helping by making sure you fully understand how this works and this implies that you have taken the time to read the documentation properly and get familiar with all the concepts.

Readers in this forum are here to help (on a completely voluntary base, if you need commercial grade support with SLAs, you can get that as well), but this goes into both directions.

Thank you.

6

is that i already read it but the example that gives the documentation is of a script with a search, and i need to put two scripts but i get the unknown field error of the script and i put it nested. for that reason i resort to the forum because there are things that do not appear in google that one can take into account. but i have not seen a watcher that has two scripts, there is no example of that to have.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.