No Results In Execution Output Watcher|Elasticsearch

Hi everyone,

I was looking at my results from my watcher and while it states execution_not_needed, when I look at the execution output, there are no results from my query.
Is this normal behaviour?

// Execution Output

{
  "watch_id": "disk_usage",
  "node": "7PFUTZb6RgKmI38clwXr2g",
  "state": "execution_not_needed",
  "user": "ttran",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2019-09-05T05:58:31.135Z"
    },
    "last_checked": "2019-09-08T05:59:05.686Z",
    "actions": {
      "notify-slack": {
        "ack": {
          "timestamp": "2019-09-05T05:58:31.135Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "execution_not_needed",
    "version": -1
  },
  "trigger_event": {
    "type": "schedule",
    "triggered_time": "2019-09-08T05:59:05.686Z",
    "schedule": {
      "scheduled_time": "2019-09-08T05:59:05.428Z"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "index*"
        ],
        "types": [
          "doc"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m"
                    }
                  }
                },
                {
                  "term": {
                    "type": {
                      "value": "node_stats"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "nodes": {
              "terms": {
                "field": "source_node.name",
                "size": 100
              },
              "aggs": {
                "total_in_bytes": {
                  "max": {
                    "field": "node_stats.fs.total.total_in_bytes"
                  }
                },
                "available_in_bytes": {
                  "max": {
                    "field": "node_stats.fs.total.available_in_bytes"
                  }
                },
                "free_ratio": {
                  "bucket_script": {
                    "buckets_path": {
                      "available_in_bytes": "available_in_bytes",
                      "total_in_bytes": "total_in_bytes"
                    },
                    "script": "params.available_in_bytes / params.total_in_bytes"
                  }
                }
              }
            }
          },
          "size": 0
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.nodes.buckets.stream().anyMatch(it -> it.free_ratio.value < ctx.metadata.lower_bound);",
      "lang": "painless"
    }
  },
  "metadata": {
    "cluster": "hrc",
    "lower_bound": 0.25
  },
  "result": {
    "execution_time": "2019-09-08T05:59:05.686Z",
    "execution_duration": 4,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 7,
          "failed": 0,
          "successful": 7,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 0,
          "max_score": null
        },
        "took": 4,
        "timed_out": false,
        "aggregations": {
          "nodes": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": []
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "index*"
          ],
          "types": [
            "doc"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "timestamp": {
                        "gte": "2019-09-08T05:59:05.428Z||-5m"
                      }
                    }
                  },
                  {
                    "term": {
                      "type": {
                        "value": "node_stats"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "nodes": {
                "terms": {
                  "field": "source_node.name",
                  "size": 100
                },
                "aggs": {
                  "total_in_bytes": {
                    "max": {
                      "field": "node_stats.fs.total.total_in_bytes"
                    }
                  },
                  "available_in_bytes": {
                    "max": {
                      "field": "node_stats.fs.total.available_in_bytes"
                    }
                  },
                  "free_ratio": {
                    "bucket_script": {
                      "buckets_path": {
                        "available_in_bytes": "available_in_bytes",
                        "total_in_bytes": "total_in_bytes"
                      },
                      "script": "params.available_in_bytes / params.total_in_bytes"
                    }
                  }
                }
              }
            },
            "size": 0
          }
        }
      }
    },
    "condition": {
      "type": "script",
      "status": "success",
      "met": false
    },
    "actions": []
  },
  "messages": []
}

// Results from just running the query:

Hi everyone,

Has anyone experienced anything similar before?
I would appreciate your feedback :slight_smile:

Hi everyone,

Following up on this, has anyone experienced something similar?

please reread the output you shared, especially this part

"result": {
    "execution_time": "2019-09-08T05:59:05.686Z",
    "execution_duration": 4,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 7,
          "failed": 0,
          "successful": 7,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 0,
          "max_score": null
        }

this is the actual output from your search. Your search did not yield any results (a count of 0), so the condition very likely did not turn out to be true and thus no actions were triggered.

Hi @spinscale

Thanks for the reply.
I was wondering why then when I just run the query without the rest of the watcher, I get an executed output with aggregations?

Nhung

you would need to replace the {{ctx.trigger.scheduled_time}} time filtering part manually.