Use watcher index action with multiple documents

Elastic Stack Kibana
1

I have an index and I am using a watcher to monitor it.
When a condition is met, I want to copy each document to a different index.

I'm following the example here:

  "index_payload": {
    "transform": {
      "script": """
      def documents = ctx.payload.hits.hits.stream()
        .map(hit -> [
          "_index": "my-index-000001", 
          "_id": hit._id, 
          "severity": "Sev: " + hit._source.severity 
        ])
        .collect(Collectors.toList());
      return [ "_doc" : documents]; 
      """
    },
    "index": {} 
  }
}

But it does not copy other fields from the original document.

Is there a way to copy all the fields AND add a new field to each document?

Thank you

2

Figured it out myself, posting here for posterity.

This code will copy each document from the input to the target index, adding a inventory_time with the time the task ran at.

"actions": {
    "index_payload": {
      "transform": {
        "script": {
          "source": """
          def documents = ctx.payload.hits.hits.stream()
            .map(hit -> [
              "_index": "daily-inventory", 
              "_id": hit._id, 
              "inventory_time": ctx['trigger']['scheduled_time'],
              "source": hit._source.entrySet().stream()
        .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue))
            ])
            .collect(Collectors.toList());
          return [ "_doc" : documents]; 
          """,
          "lang": "painless"
        }
      },
      "index": {}
    }
  }
1 Like
3

And if you want a new document to be created each time, get rid of the "_id" field. A new one will be generated each time the script runs

1 Like
4

Thanks for sharing your solution @lizozom

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.