Math Calculation in Elastic Watcher not working

Elastic Stack Elasticsearch
,
1

I had the below response I am receiving from Elastic dev tools and I need to calculate the % difference increase/decrease between the 2 aggregation count.

{
"alternative_input": {
"hits": {
"total": {
"value": 33909841,
"relation": "eq"
},
"max_score": null,
"hits":
},
"aggregations": {
"second_interval_events": {
"meta": {},
"doc_count": 1300
},
"first_interval_events": {
"meta": {},
"doc_count": 1400
}
}
},
"ignore_condition": true,
"action_modes": {
"email": "force_execute"
},
"record_execution": true
}

Requirement : in condition need to check if the % diff is more than 35 , then need to trigger alert and in the Mail we need to show how much % difference

Condition Code:

"condition": {
"script": {
"source": "return (((ctx.payload.aggregations.first_interval_events.doc_count - ctx.payload.aggregations.second_interval_events.doc_count)*100/ctx.payload.aggregations.first_interval_events.doc_count) > Integer.parseInt(params.threshold));",
"params":{
"threshold" : "0.35"
},
"lang": "painless"
}
},

Above condition not working and for verification i made threshold 0 and able to see email, but not sure how to calcualte Percentage difference to show it Email subject.

Used transform

"actions": {
"email": {
"transform": {
"script": {
"source": " return ['percentageDiff': (ctx.payload.aggregations.first_interval_events - ctx.payload.aggregations.second_interval_events / ctx.payload.aggregations.first_interval_events)*100]",
"lang": "painless"
}
},

If i am trying to refer {{ctx.payload.percentageDiff}} in email , its value always coming as 0.

2

Did you try 100.0 otherwise I think the whole calculation gets converted to integer.
Also, you should probably set that as a parameter

3

I had tried the below snippet for transform

"transform": {
    "script": {
      "source": "return [
'first': ctx.payload.aggregations.first_interval_events, 'second':ctx.payload.aggregations.second_interval_events , 
'percentageDiff':
(ctx.payload.aggregations.first_interval_events.doc_count - ctx.payload.aggregations.second_interval_events.doc_count / (ctx.payload.hits.total/2))*100.0 ]",
      "lang": "painless"
    }
  },

Error:

[320](;#L320) "return ['first': ctx.payload.aggregations.first_interval_events, 'second':ctx.payload.aggregations.second_interval_events , 'percentageDiff':(ctx.payload.aggregations.first_interval_events.doc_count - ctx.payload.aggregations.second_interval_events.doc_count / (ctx.payload.hits.total/2))*100.0 ]",

[321](;#L321) " ^---- HERE"

[322](;#L322) ],

[323](;#L323) "script": "return ['first': ctx.payload.aggregations.first_interval_events, 'second':ctx.payload.aggregations.second_interval_events , 'percentageDiff':(ctx.payload.aggregations.first_interval_events - ctx.payload.aggregations.second_interval_events / ctx.payload.agg ...",

[324](;#L324) "lang": "painless",

[325](;#L325) "position": {

[326](;) "offset": 265,

[327](;#L327) "start": 0,

[328](;#L328) "end": 296

[329](;#L329) },

[330](;#L330) "caused_by": {

[331](;#L331) "type": "class_cast_exception",

[332]( "reason": "Cannot apply [/] operation to types [java.util.HashMap] and [java.lang.Integer]"
}
        }
      },
"actions": []
    },
    "messages": [
      "failed to execute watch transform"
    ]
4

The error states you are

Looks like this is invalid

(ctx.payload.hits.total/2))

Perhaps look here for some example