Apologies if this has been asked before, but i'm really stumped on this. What i'm trying to do is populate an email action in Watcher with a list of all results where an aggregation returns a doc_count > 5. I know the problem is within the action transform but I can't figure out the syntax I am looking for. Removed some info from the query and the actions for privacy reasons.
{
"trigger": {
"schedule": {
"interval": "15m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"heartbeat-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"from": "now-15m",
"to": "now"
}
}
}
],
"filter": [
{
"bool": {
"filter": [
{
"bool": {
"should": [
{
"match_phrase": {
"monitor.status": "down"
}
}
]
}
}
]
}
}
]
}
},
"aggs": {
"endpoints_down": {
"terms": {
"field": "agent.hostname",
"size": 50
},
"aggs": {
"endpoint": {
"terms": {
"field": "url.full",
"size": 50
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "return ctx.payload.aggregations.endpoints_down.buckets.size() > 0",
"lang": "painless"
}
},
"actions": {
"send_email": {
"transform": {
"script": {
"source": "return ctx.payload.aggregations.endpoints_down.buckets.stream().map(e -> e.key).collect(Collectors.toList());",
"lang": "painless"
}
}
}
}
}