Referencing a simple input from a different input in a watcher

[yesman]

Howdy Y'all,

My team is trying to construct a watcher that uses the strings defined in the simple input section and places them into the search input section so I can rapidly create multiple watchers by only having to modify the simple input section. For some additional context, we want to do this because we have to create a lot of watchers for different policies, and each watcher will have many different inputs, so being able to do this would save us a lot of time especially if we need to change the process in the future.

In my JSON, I pass in the simple inputs into the parameters of my search template but it interprets it literally as a string ("{{ctx.payload.first.process}}" rather than "java"). How can I force it to substitute the variable as the query? Is what I am trying to do even possible?

Below is example JSON of my watcher where I try and pass in the simple inputs:

//my Watcher JSON

"input" : {
    "chain": {
        "inputs": [
        {
            "first": {
                "simple": {
                    "process": "java"
                }
            }
        },
        {   
            "second": {
                "search": {
                    "request": {
                        "search_type": "query_then_fetch",
                        "indices": [ "metricbeat-2018-11-13" ],
                        "types": ,
                        "template": {
                        "id": "Template",
                        "params": {
                            "ctx_payload_first_process": "{{ctx.payload.first.process}}"
                            }
                        }
                    }   
                }
            }
        }]
    }
}

Once again, under params, it interprets "ctx_payload_first_process" as the literal string
"{{ctx.payload.first.process}}" and not the actual process "java" that I have defined in the simple input when I attempt to reference this data later. Any help/information is greatly appreciated!

Many thanks,

Yes Man

[spinscale (Alexander Reelsen)]

Hey,

unfortunately it is not always clear, when a field is treated as a mustache template or when it is just treated as a string - which is the case here.

A workaround to this would be to use a search with a body, as the body is treated as a mustache template, so you can use the {{ctx.payload.first.process}} in there.

--Alex

[yesman]

Hey @spinscale,

Thanks for the response, using a search with a body fixed our issues!

Much appreicated,

Yes Man