Increment date field watcher

[Cheroufa]

hello team,

i want to increment date field """ {{ctx.payload.second.time}} + 30m """ in watcher but i don't know how to do it, any idea ?

my code :

"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"index-1-"
],
"rest_total_hits_as_int": true,
"body": {
"size": 2,
"query": {
"bool": {
"should": [
{
"term": {
"a.keyword": ""
}
},
{
"term": {
"n.keyword": ""
}
}
],
"minimum_should_match": 2
}
},
"sort": [
{
"date": {
"order": "desc"
}
}
]
}
}
}
}
},
{
"second": {
"transform": {
"script": {
"source": "return [ 'time' : ctx.payload.first.hits.hits.0._source.date ]",
"lang": "painless"
}
}
}
},
{
"third": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"index-2-"
],
"rest_total_hits_as_int": true,
"body": {
"size": 1,
"query": {
"bool": {
"must": [
{
"term": {
"c.keyword": ""
}
},
{
"term": {
"en.keyword": "*"
}
},
{
"term": {
"order_file_type.keyword": ""
}
},
{
"range": {
"metadata.ingested": {
"gte": "{{ctx.payload.second.time}}"
"lte":"{{ctx.payload.second.time}} + 30"
}
}
}
]
}
},
"aggs": {
"1": {
"cardinality": {
"field": "filename.keyword"
}
}
}
}
}
}
}
}
]
}
},

thanks for help.

[richcollier]

Requires use of || like this (also see docs:

"range": {
"metadata.ingested": {
"gte": "{{ctx.payload.second.time}}"
"lte":"{{ctx.payload.second.time}}|| + 30m"
}

[Cheroufa]

it does'nt work with your solution.

i use this script :

      "script": {		
      "source": """
                String datetime = ctx.payload.first.hits.hits.0._source['@timestamp'];
                return [
                  'from' : datetime,
                  'to' : ZonedDateTime.parse(datetime).plusMinutes(30)
                ]""",
              "lang": "painless"
           }

it works for : @timestamp = "2022-06-27T05:15:04.986Z"
but not for a other field : ctx.payload.first.hits.hits.0._source.dateField
dateField = "2022-06-27T05:15:04.986+0000"

is it due to the date format ?

[richcollier]

If your field that you want to do date math on is of type date then it will work. What is the mapping type for the field dateField?

edit: changed bad grammar

[Cheroufa]

dateField is of type date too

[richcollier]

You can see an example of this kind of date math here on line 57

You must have a problem elsewhere. Is the code at the top your actual Watch definition?