Unknown input type [condition]

Elastic Stack Elasticsearch
1

Noob question here (or dumb on a Sunday morning :slight_smile: ). I am getting one of these when tryng to register a watch:
{"error":"WatcherException[failed to put watch [mysql_slow_watch]]; nested: InputException[could not parse input for watch [mysql_slow_watch]. unknown input type [condition]]; ","status":500}

My Watch looks like this:

curl -XPUT 'http://[my_host]:[my_port]/_watcher/watch/mysql_slow_watch' -d '{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "myindex" ],
"body" : {
"query": {
"bool": {
"must": [
{
"range": {
"query_data.queryTime": {
"from": 10
}
}
}
],
"must_not": [],
"should": []
}
},
"filter": {
"range": {
"@timestamp" : {
"from": "{{ctx.trigger.scheduled_time}}||-10s",
"to": "{{ctx.trigger.triggered_time}}"
}
}
}
}

}

},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gte" : 1 }}
},
"actions" : {
"log_error" : {
"logging" : {
"text" : "Found {{ctx.payload.hits.total}} Slow Queries Found"
}
}
}
}'

Can someone tell me what I have missed here? Do I have to create a mapping for 'mysql_slow_watch', like a normal ES index (I thought that was what this should do).

Thanks

Peter C

2

Hi Peter, it looks like the request JSON is missing a closing curly brace at the end of the "input" object. Once you add it, the request JSON will look like this:

{
  "trigger": {
    "schedule": { "interval": "10s" }
  },
  "input": {
    "search": {
      "request": {
        "indices": [ "myindex" ],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "range": {
                    "query_data.queryTime": {
                      "from": 10
                    }
                  }
                }
              ],
              "must_not": [],
              "should": []
            }
          },
          "filter": {
            "range": {
              "@timestamp": {
                "from": "{{ctx.trigger.scheduled_time}}||-10s",
                "to": "{{ctx.trigger.triggered_time}}"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": { "ctx.payload.hits.total":{ "gte":1 } }
  },
  "actions": {
    "log_error": {
      "logging": {
        "text": "Found {{ctx.payload.hits.total}} Slow Queries Found"
      }
    }
  }
}
3

Shaunak.. thank you.. that was extremely dumb of me.. show why you should wake up before playing with new software.
Thanks again....
Peter C

4

No problem! We've all been there :stuck_out_tongue_winking_eye: