Payload total and output value do not match

[Shaw (Shaw Ng)]

Hi,

When I setup a new Watcher, the payload total has like 38 records but the output result only gives 10, even refresh every time with different total the output stays 10, is it because the Simulation Results only give 10 max? Please advice.

Partial Script
...
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"send_email": {
"transform": {
"script": {
"source": "def userhost= ctx.payload.hits.hits.stream().map(hit -> 'User: ' + hit._source['user'] + ' - Hostname: ' + hit._source['hostname']).collect(Collectors.toList()); userhost.add(' Total: ' + userhost.length); return userhost;",
"lang": "painless"
...

Simulated Result
...
"ctx.payload.hits.total": 38
}
}
},
"actions": [
{
"id": "send_email",
"type": "email",
"status": "simulated",
"transform": {
"type": "script",
"status": "success",
"payload": {
"_value": [
"User: xxx - Hostname: xxx",
...
" Total: 10"
]

[spinscale (Alexander Reelsen)]

Hey,

by default elasticsearch only returns the first ten results. If you want to change this behaviour, you need to tweak the size parameter of a search request.

--Alex

[Shaw (Shaw Ng)]

@spinscale

by default elasticsearch only returns the first ten results. If you want to change this behaviour, you need to tweak the size parameter of a search request.

Thank you @spinscale. Your suggestion works!