Watch condition not met even though it should be

Elastic Stack Elasticsearch
1

So i have an alert that as best as I can tell isn't completing the actions even though it should. Here are the pertinant parts of my watch and results:

watch:
"aggs": {
"avg_cst": {
"avg": {
"field": "CST"
}
}
}

"condition": {
    "compare": {
      "ctx.payload.aggregations.avg_cst": {
        "gte": 500
      }
    }
  }

result:
"condition": {
"type": "compare",
"status": "success",
"met": false,
"compare": {
"resolved_values": {
"ctx.payload.aggregations.avg_cst": {
"value": 1137.616451810927
}
}
}
}

As 1137.616451810927 is clearly greater than or equal to 500 i'm not quite sure why my condition has "met":false Any help would be greatly appreciated.

2

I recreated my watch after successfully getting a different watch which uses compare(but no aggregation) to work. However the new watch doesn't work either and i copied the body of the working watch and just tweaked it. Here is my watch results:

{
  "watch_id": "CST_Watch",
  "state": "execution_not_needed",
 "_status": {
     "state": {
  "active": true,
  "timestamp": "2017-07-20T15:48:39.247Z"
},
"last_checked": "2017-07-20T16:03:39.530Z",
"actions": {
  "my-logging-action": {
    "ack": {
      "timestamp": "2017-07-20T15:48:39.247Z",
      "state": "awaits_successful_execution"
    }
  },
  "send_email": {
    "ack": {
      "timestamp": "2017-07-20T15:48:39.247Z",
      "state": "awaits_successful_execution"
    }
  }
}
   },
   "trigger_event": {
     "type": "schedule",
     "triggered_time": "2017-07-20T16:03:39.530Z",
     "schedule": {
       "scheduled_time": "2017-07-20T16:03:39.257Z"
     }
   },
   "input": {
     "search": {
  "request": {
    "search_type": "query_then_fetch",
    "indices": [
      "ts*"
    ],
    "types": [],
    "body": {
      "size": 0,
      "query": {
        "bool": {
          "must": [
            {
              "range": {
                "dt": {
                  "gte": "now-24h"
                }
              }
            }
          ]
        }
      },
      "aggs": {
        "avg_cst": {
          "avg": {
            "field": "CallSetupTime"
          }
        }
      }
    }
  }
}
   },
   "condition": {
"compare": {
  "ctx.payload.aggregations.avg_cst": {
    "gte": 500
  }
}
   },
   "metadata": {
     "name": "Call Setup Time Watch"
   },
   "result": {
"execution_time": "2017-07-20T16:03:39.530Z",
"execution_duration": 20,
"input": {
  "type": "search",
  "status": "success",
  "payload": {
    "_shards": {
      "total": 75,
      "failed": 0,
      "successful": 75
    },
    "hits": {
      "hits": [],
      "total": 505829,
      "max_score": 0
    },
    "took": 19,
    "timed_out": false,
    "aggregations": {
      "avg_cst": {
        "value": 1204.9892663064395
      }
    }
  },
  "search": {
    "request": {
      "search_type": "query_then_fetch",
      "indices": [
        "ts*"
      ],
      "types": [],
      "body": {
        "size": 0,
        "query": {
          "bool": {
            "must": [
              {
                "range": {
                  "dt": {
                    "gte": "now-24h"
                  }
                }
              }
            ]
          }
        },
        "aggs": {
          "avg_cst": {
            "avg": {
              "field": "CallSetupTime"
            }
          }
        }
      }
    }
  }
},
"condition": {
  "type": "compare",
  "status": "success",
  "met": false,
  "compare": {
    "resolved_values": {
      "ctx.payload.aggregations.avg_cst": {
        "value": 1204.9892663064395
      }
    }
  }
},
"actions": []
   },
   "messages": []
 }
3

Hey,

try ctx.payload.aggregations.avg_cst.value as the path for the compare condition, seems you are trying to compare an object and not the full path to that number.

--Alex

4

Alex,

Thanks for getting back to me. I had worked that out after finally spotting the .value attribute in a video somewhere and tried it. None of the Examples of the aggregations that I found showed how use them so I had never seen the .value before. Thanks for the help.

Dave

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.