No Results In Execution Output Watcher|Elasticsearch

Elastic Stack Elasticsearch
1

Hi everyone,

I was looking at my results from my watcher and while it states execution_not_needed, when I look at the execution output, there are no results from my query.
Is this normal behaviour?

// Execution Output

{
  "watch_id": "disk_usage",
  "node": "7PFUTZb6RgKmI38clwXr2g",
  "state": "execution_not_needed",
  "user": "ttran",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2019-09-05T05:58:31.135Z"
    },
    "last_checked": "2019-09-08T05:59:05.686Z",
    "actions": {
      "notify-slack": {
        "ack": {
          "timestamp": "2019-09-05T05:58:31.135Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "execution_not_needed",
    "version": -1
  },
  "trigger_event": {
    "type": "schedule",
    "triggered_time": "2019-09-08T05:59:05.686Z",
    "schedule": {
      "scheduled_time": "2019-09-08T05:59:05.428Z"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "index*"
        ],
        "types": [
          "doc"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m"
                    }
                  }
                },
                {
                  "term": {
                    "type": {
                      "value": "node_stats"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "nodes": {
              "terms": {
                "field": "source_node.name",
                "size": 100
              },
              "aggs": {
                "total_in_bytes": {
                  "max": {
                    "field": "node_stats.fs.total.total_in_bytes"
                  }
                },
                "available_in_bytes": {
                  "max": {
                    "field": "node_stats.fs.total.available_in_bytes"
                  }
                },
                "free_ratio": {
                  "bucket_script": {
                    "buckets_path": {
                      "available_in_bytes": "available_in_bytes",
                      "total_in_bytes": "total_in_bytes"
                    },
                    "script": "params.available_in_bytes / params.total_in_bytes"
                  }
                }
              }
            }
          },
          "size": 0
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.nodes.buckets.stream().anyMatch(it -> it.free_ratio.value < ctx.metadata.lower_bound);",
      "lang": "painless"
    }
  },
  "metadata": {
    "cluster": "hrc",
    "lower_bound": 0.25
  },
  "result": {
    "execution_time": "2019-09-08T05:59:05.686Z",
    "execution_duration": 4,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 7,
          "failed": 0,
          "successful": 7,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 0,
          "max_score": null
        },
        "took": 4,
        "timed_out": false,
        "aggregations": {
          "nodes": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": []
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "index*"
          ],
          "types": [
            "doc"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "timestamp": {
                        "gte": "2019-09-08T05:59:05.428Z||-5m"
                      }
                    }
                  },
                  {
                    "term": {
                      "type": {
                        "value": "node_stats"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "nodes": {
                "terms": {
                  "field": "source_node.name",
                  "size": 100
                },
                "aggs": {
                  "total_in_bytes": {
                    "max": {
                      "field": "node_stats.fs.total.total_in_bytes"
                    }
                  },
                  "available_in_bytes": {
                    "max": {
                      "field": "node_stats.fs.total.available_in_bytes"
                    }
                  },
                  "free_ratio": {
                    "bucket_script": {
                      "buckets_path": {
                        "available_in_bytes": "available_in_bytes",
                        "total_in_bytes": "total_in_bytes"
                      },
                      "script": "params.available_in_bytes / params.total_in_bytes"
                    }
                  }
                }
              }
            },
            "size": 0
          }
        }
      }
    },
    "condition": {
      "type": "script",
      "status": "success",
      "met": false
    },
    "actions": []
  },
  "messages": []
}

// Results from just running the query:

1 Like
2

Hi everyone,

Has anyone experienced anything similar before?
I would appreciate your feedback :slight_smile:

3

Hi everyone,

Following up on this, has anyone experienced something similar?

4

please reread the output you shared, especially this part

"result": {
    "execution_time": "2019-09-08T05:59:05.686Z",
    "execution_duration": 4,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 7,
          "failed": 0,
          "successful": 7,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 0,
          "max_score": null
        }

this is the actual output from your search. Your search did not yield any results (a count of 0), so the condition very likely did not turn out to be true and thus no actions were triggered.

5

Hi @spinscale

Thanks for the reply.
I was wondering why then when I just run the query without the rest of the watcher, I get an executed output with aggregations?

Nhung

6

you would need to replace the {{ctx.trigger.scheduled_time}} time filtering part manually.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.