Multiple Condition using ctx.execution_time

Elastic Stack Elasticsearch
1

Hey there,

I am currently polling an endpoint over https for the cluster's health status, and I would like an alert sent if the returned status is a certain value and if it's not between certain times in the day (when our logs rotate, which causes a yellow status).

At first I tried this:

"condition": {
"compare": {
"ctx.payload.status": {
"eq": "yellow"
},
"ctx.execution_time": {
"gte": "<{now/d+5m}>"
}
}
},

However, although there was no error, the first condition isn't saved - if I reopen my Watcher the first one is gone.

I tried to rewrite it as a script, but that created a second issue:

"condition": {
"script": {
"source" : "return ( ctx.payload.status == params.color && ctx.execution_time > params.after)",
"params" : {
"color" : "yellow",
"after" : "now/d+5m"
}
}
},

I'm not sure how/whether I should be converting ctx.execution_time (what's an easy way to tell if it's a string or date type within a script?) and any parameters I pass seem to be treated as strings.

What's the best way to do this? Thanks in advance!

2

Hey,

thanks for reporting. We should indeed return a proper error message, when you specify more than one field. If you GET the watch, the first condition will be gone. I opened #31852 to fix this in the future.

Using a script condition is indeed the way to go here. However you cannot use date math in there, this only works when specifying indices or inside of queries, but not when doing scripting. Instead you need to do something like this

POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
      }
    },
    "input": {
      "none": {}
    },
    "actions": {
      "logme": {
        "transform": {
          "script": "return Instant.ofEpochMilli(ctx.execution_time.getMillis()).plus(5, ChronoUnit.DAYS).truncatedTo(ChronoUnit.DAYS).toString();"
        },
        "logging": {
          "text": "{{ctx.payload}}"
        }
      }
    }
  }
}

This might not be exactly what you want, but I hope it gets you a first impression how to change the data.

Hope this helps!

--Alex