Parse the values from aggregation results in watcher transform painless script

Elastic Stack Elasticsearch
,
1

Hello @Badger , @magnusbaeck

Please help on painless script for parsing the timestamp and compare with now-1h.
'''
"aggs": {
"by_index": {
"terms": {
"field": "_index"
},
"aggs": {
"by_timestamp": {
"max": {
"field": "@timestamp"
}
}
}
}
}
'''
I have the aggregated result as below
'''
"aggregations" : {
"by_index" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 607,
"buckets" : [
{
"key" : "watcher-alert-index1-2023.08.08",
"doc_count" : 832,
"by_timestamp" : {
"value" : 1.691515913592E12,
"value_as_string" : "2023-08-08T17:31:53.592Z"
}
},
{
"key" : "watcher-alert-index1-2023.08.07",
"doc_count" : 623,
"by_timestamp" : {
"value" : 1.691423470253E12,
"value_as_string" : "2023-08-07T15:51:10.253Z"
}
]
}
}
'''
I want to parse the timestamp from the above using painless script from the above result and compare with now-1h in watcher snippet.

I am new to painless script.

Please help me on this and guide me.

Thanks in advance,
Pavani

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.