Looping through aggregations result

Elastic Stack Elasticsearch
1

Hi,

So I'm trying to create an email action that shows me weekly a summary of all the watches that I currently have running. I'm having trouble displaying it nicely though and it would be nice if I could display the results form my aggregation a bit nicer than what I can currently do.

POST _xpack/watcher/watch/currentActiveWatches
{
  "trigger": {
    "schedule": {
      "interval": "5s"
    }
  },
  "input": {
    "http": {
      "request": {
        "host": "XXXXX",
        "port": 9200,
        "path": ".watcher-history*/_search",
        "body": "{\"_source\": [\"watch_id\" ],  \"query\": { \"wildcard\": { \"watch_id\": \"A*\"   }},
\"aggs\": {\"distinct_watches\": { \"terms\": {\"field\": \"watch_id\",   \"size\": 15 }      }}        }"
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "from": "XX@X.com",
        "to": "XX@XX.com",
        "subject": "{{ctx.payload.aggregations.distinct_watches.buckets}} ",
        "body": "{{ctx.payload.aggregations.distinct_watches.buckets.0.key}}"
      }
    }
  }
}

The results of the code I have in the "subject" look like this:

{0={key=AcTag-CM-1234, doc_count=24182}, 1={key=AcTag-W-21308, doc_count=15885}, 2={key=AcTag-D-10705, doc_count=15849}, 3={key=AcTag-test, doc_count=5491}, 4={key=AcTag-Test, doc_count=102}, 5={key=AcTag-Test1, doc_count=78}

I'd ideally have an array or list or table that can show these results rather than just this massive ugly text. Is there some way to make this look nicer?

And the results in the body only show one watch and I can't seem to say [0-], [0,] or anything like that to say that I want ALL of the results that I get from the given aggregation.

Any direction is appreciated!

2

Hey,

sorry for the late reply, this one got overlooked somehow. So, you can loop through a list with mustache.

See https://www.elastic.co/guide/en/elasticsearch/reference/5.3/search-template.html#_more_template_examples and a concrete example looping through aggregation buckets is at https://www.elastic.co/guide/en/x-pack/5.3/watching-meetup-data.html

Hope this helps!

--Alex

3

Ok great. So the

{{#ctx.payload.aggregations.group_by_city.buckets}}{{key}} {{/ctx.payload.aggregations.group_by_city.buckets}}

Is the way to do this if anyone in the future is interested. This is the mustache language.

Thanks for the help Alex!

3 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.