Inline success script move to stored failed in transform watcher

Elastic Stack Elasticsearch
1

Hi, all

The follow is run correct.

  "transform": {
    "script": {
      "source": "return ['error_count' : ctx.payload.aggregations.whichHost.buckets.length, 'hosts' : ctx.payload.aggregations.whichHost.buckets.stream().map(item -> item.key).collect(Collectors.toList()).join(', '), 'process' : 'ntpd' ]",
      "lang": "painless"
    }
  }

But I got a "internal server error", just moving the source in a file.

The script file:

{
  "script": {
    "lang": "mustache",
    "source": "return ['error_count' : ctx.payload.aggregations.whichHost.buckets.length, 'hosts' : ctx.payload.aggregations.whichHost.buckets.stream().map(item -> item.key).collect(Collectors.toList()).join(', '), 'process' : 'ntpd' ]"
  }
}

The snippet in the watcher

  "transform": {
    "script": {
        "id": "script_process_trans",
      "lang": "painless"
    }
  }

I'm sure the filename is right.

How can I ......

PS. could not use the error information like that? :sob: The user saw it will be crazy.

2

The file script should only contain the source, not any json. Eg, scripts/script_process_trans.mustache:

return ['error_count' : ctx.payload.aggregations.whichHost.buckets.length, 'hosts' : ctx.payload.aggregations.whichHost.buckets.stream().map(item -> item.key).collect(Collectors.toList()).join(', '), 'process' : 'ntpd' ]

(although note that does not look like mustache, you likely meant it to be painless, as indicated in the usage in your last snippet)

3

Finally, I want to send some params in the mushache, and then use it in the transform section.

the mushache named "script_process_trans"

{
  "script": {
    "lang": "mustache",
    "source": "return ['error_count' : ctx.payload.aggregations.{{buckets_name}}.buckets.length, 'hosts' : ctx.payload.aggregations.{{buckets_name}}.buckets.stream().map(item -> item.key).collect(Collectors.toList()).join(', '), 'process' : '{{process_name}}' ]"
  }
}

And the snippet of the watcher:

  "transform": {
    "script": {
        "id": "script_process_trans",
      "lang": "painless",
      "params": {
        "buckets_name": "whichHost",
        "process_name": "ntpd"
      }
    }
  }

After I got a "internal system error", I track the error. And then discovery the error will be caused only when include the file without params.

But it's success like it in the condition section.

The script named script_bucket_no_empty

{
  "script": {
    "lang": "mustache",
    "source": "return ctx.payload.aggregations.{{bucket_name}}.buckets.length > 0"
  }
}

And use it successful followed:

  "condition": {
    "script": {
      "id": "script_bucket_no_empty",
      "lang": "painless",
      "params": {
        "bucket_name": "whichHost"
      }
    }
  },

I don't know what is different?
I am a newbie for this, maybe the question is stupid. :blush:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.