Snapshot watcher - when there are more multiple repositories to be watched

Elastic Stack Kibana
, ,
1

Hi,

With the help from multiple discussions in this forum, I'm able to create a watcher to look for any snapshots in 'failed' state in a given snapshot repository.

{
	"trigger": {
		"schedule": {
			"interval": "60s"
		}
	},
	"input": {
		"http": {
			"request": {
				"scheme": "https",
				"host": "hostname",
				"port": 9656,
				"method": "get",
				"path": "/_snapshot/repo_name/_all",
				"params": {},
				"headers": {},
				"auth": {
					"basic": {
						"username": "user",
						"password": "password"
					}
				}
			}
		}
	},
	"condition": {
		"array_compare": {
			"ctx.payload.snapshots": {
				"path": "state",
				"eq": {
					"value": "FAILED"
				}
			}
		}
	},
	"actions": {
		"email_action": {
			"transform": {
				"script": {
					"source": "return [ 'failed_snapshots' : ctx.payload.snapshots.stream().filter( s -> s.state == 'FAILED').collect(Collectors.toList()) ]",
					"lang": "painless"
				}
			},
			"email": {
				"profile": "standard",
				"priority": "high",
				"to": [
					"email"
					],
				"subject": "Snapshot Watcher Alert",
				"body": {
					"text": "The following Snapshots failed: {{#ctx.payload.failed_snapshots}} {{snapshot}},{{state}},{{shards}} : {{/ctx.payload.failed_snapshots}} "
				}
			}
		}
	}
}

Now, I've multiple repositories to lookout for. How can I loop through multiple repositories for failed snapshots without creating a new watcher for all my individual repos.

Is it possible to use chained input, with first input to fetch all the snapshots available and second input to fetch the snapshots with each repository using {{#ctx.payload.first}}..{{/ctx.payload.first}} ?

appreciate your thoughts/inputs.

2

Have you tried /_snapshot/_all/_all?

3

GET _snapshot/_all/_all - gives a repository missing exception.

4

Indeed.. according to the docs this should work, but it does not. A current workaround could be to have more than one input where each calls the snapshots of one repository using the chain input. See Watcher chain input | Elasticsearch Guide [7.13] | Elastic

5

If chain input is used, is it possible to process and return more than one value in my transform ? I'll have to process ctx.payload.first and ctx.payload.second seperately, and return failed snapshots ? is return more than one value possible?

6

you can return a hashmap in your transform like return ["a":"first", "b": "second"]

7

Thank you Alex. It works.

One more question though. In this case, i'm working with snapshots and not a search. So, ctx.payload.hits.hits/total won't help me isnt it? Is there a way to get the count of snapshots or any non-search input, in the payload ?

8

@spinscale , any help appreciated.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.