How to use aggregation fields in Watcher action body (with foreach loop)?

Hi there.

I'm currently trying to create a watcher with foreach loop (per aggregation bucket).
The actual loop works fine. Though, I have a problem accessing "ctx.payload.aggregations." to include a specific field from it in the body. Action is triggered and emails are generated, but without this data.

Here's the action:

  "actions": {
    "send_email": {
      "foreach" : "ctx.payload.aggregations.hosts.buckets",
      "email": {
        "profile": "standard",
        "to": [
          "some@mail"
        ],
        "subject": "POS Watcher",
        "body": {
          "text": "{{ctx.payload.aggregations.hosts.buckets._key}}"
        }
      }
    }
  }

And the aggregation itself:

        "aggregations": {
          "hosts": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "doc_count": 2,
                "min_term": {
                  "value": -402
                },
                "key": "l-kv-tych1o-016"
              },
              {
                "doc_count": 2,
                "min_term": {
                  "value": -620
                },
                "key": "l-rv-shuk12-045"
              }
            ]
          }
        }

Would really appreciate some help.

Regard, Yaroslav.

Ok, found it out by my own. Here's the solution, maybe it helps someone one day)

In foreach looping through buckets, each bucket itself becomes ctx.payload "root".
This works as intended, returning specific field from each bucket:

  "actions": {
    "send_email": {
      "foreach" : "ctx.payload.aggregations.hosts.buckets",
      "email": {
        "profile": "standard",
        "to": [
          "some@mail"
        ],
        "subject": "POS Watcher",
        "body": {
          "text": "{{ctx.payload.key}}"
        }
      }
    }
  }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.