Using Bucket Fields in Watcher

Elastic Stack Elasticsearch
1

Hi,

My goal: To create an alert that tells me when a customer has not received a log.

My problem: The name of the customer is within an aggregated field.

My question: How do I retrieve the customer name and how can I incorporate this changing field into in the action?

// Below is my watcher thus far

// Below is the aggregated query. Is it possible to retrieve the "key" field and have it appear in my action?

Any advice is greatly appreciated! :slight_smile:
Thank you in advance

2

please share the output of the Execute Watch API, which makes it a lot easier to follow your steps.

3

Hi @spinscale,

I have yet to do my "action" section, which is where I am struggling.
For the time being, I have put in a "text" action.

//Watcher Executed output

Thank you,
Nhung

4

I don't know if this is correct, but am I on somewhat on the right track?

// Watcher action

5

I just realized we are talking across two threads here. I will stop replying to this one. Please keep it to a single thread. Thanks!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.