How to Compare two different fields value of two different index?

Elastic Stack Elasticsearch
4

Here's a simple example of comparing two simple static values:

#sample watch comparing two values
POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "1m"
      }
    },
    "input": {
      "chain": {
        "inputs": [
          {
            "first": {
              "simple": {
                "value": "4"
              }
            }
          },
          {
            "second": {
              "simple": {
                "value": "4"
              }
            }
          }
        ]
      }
    },
    "condition": {
      "script": {
        "source": "return ctx.payload.second.value.equals(ctx.payload.first.value)"
      }
    },
    "actions": {
      "log": {
        "logging": {
          "text": "they are equal!"
        }
      }
    }
  }
}

In this case, if the two values are equal, the Watch will log "they are equal!", otherwise nothing will happen.

A snippet of the output if run in Dev Tools Console is:

      "condition": {
        "type": "script",
        "status": "success",
        "met": true
      },
      "actions": [
        {
          "id": "log",
          "type": "logging",
          "status": "success",
          "logging": {
            "logged_text": "they are equal!"
          }
        }
      ]
    },
    "messages": []
  }
}

If the two input chains are actual queries (instead of silly simple static values), then the structure will be more complicated. For example, here I'm counting the total number of anomalies found (above a score of 75) for two different ML jobs over the last 2 years :

#sample watch comparing volume of two indices
POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "1m"
      }
    },
    "input": {
      "chain": {
        "inputs": [
          {
            "first": {
              "search": {
                "request": {
                  "indices": [
                    ".ml-anomalies-*"
                  ],
                  "body": {
                    "query": {
                      "bool": {
                        "filter": [
                          {
                            "range": {
                              "timestamp": {
                                "gte": "now-2y"
                              }
                            }
                          },
                          {
                            "term": {
                              "result_type": "bucket"
                            }
                          },
                          {
                            "term": {
                              "job_id": "farequote"
                            }
                          },
                          {
                            "range": {
                              "anomaly_score": {
                                "gte": "75"
                              }
                            }
                          }
                        ]
                      }
                    }
                  }
                }
              }
            }
          },
          {
            "second": {
              "search": {
                "request": {
                  "indices": [
                    ".ml-anomalies-*"
                  ],
                  "body": {
                    "query": {
                      "bool": {
                        "filter": [
                          {
                            "range": {
                              "timestamp": {
                                "gte": "now-2y"
                              }
                            }
                          },
                          {
                            "term": {
                              "result_type": "bucket"
                            }
                          },
                          {
                            "term": {
                              "job_id": "gallery"
                            }
                          },
                          {
                            "range": {
                              "anomaly_score": {
                                "gte": "75"
                              }
                            }
                          }
                        ]
                      }
                    }
                  }
                }
              }
            }
          }
        ]
      }
    },
    "condition": {
          "compare" : { "ctx.payload.first.hits.total" : { "eq" : "{{ctx.payload.second.hits.total}}" }}
    },
    "actions": {
      "log": {
        "logging": {
          "text": "they are equal!"
        }
      }
    }
  }
}

If the number of the anomalies found is the same, then the message is logged. Here's a snippet of the watch output showing that in my case, this second example didn't match (the condition was not met):

     "condition": {
        "type": "compare",
        "status": "success",
        "met": false,
        "compare": {
          "resolved_values": {
            "ctx.payload.second.hits.total": 55,
            "ctx.payload.first.hits.total": 6
          }
        }
      },
      "actions": []
    },
    "messages": []
  }
}

Notice that I have used two different approaches for the condition block - the first uses a script and the second uses a compare.

Hope this helps.

1 Like