Hi,
Very new to elastic. Trying to setup a watch where my ultimate goal is to have an action on slack but first testing it out using a simple logging action.
My problem is - when I look at the execution history of the watch- it just does not get past the "firing state". I would expect that once an execution is done, it would move to "Ok".
By going through the resources online , I can understand that there is some kind of throttling involved but I fail to understand why is that for the first execution of the watch because when I look at the details of the json of any particular execution, including the first (my watch runs every 10 mins), I see the logging action printing out - "0 documents". If it is able to print, why is it not moving to "Ok" state? Also, when I look at "action statuses", I can see the option to "acknowledge" and if I do that , all future executions move to "acked".
Can someone please why is it stuck, even though I can see the logged text, when I click on the "execution history" of any particular execution? Here is the result of one-
{
"watch_id": "abc",
"node": "def",
"state": "executed",
"user": "demosum",
"status": {
"state": {
"active": true,
"timestamp": "2021-02-15T13:23:23.949Z"
},
"last_checked": "2021-02-15T14:13:24.418Z",
"last_met_condition": "2021-02-15T14:13:24.418Z",
"actions": {
"my-logging-action": {
"ack": {
"timestamp": "2021-02-15T13:33:24.400Z",
"state": "ackable"
},
"last_execution": {
"timestamp": "2021-02-15T14:13:24.418Z",
"successful": true
},
"last_successful_execution": {
"timestamp": "2021-02-15T14:13:24.418Z",
"successful": true
}
}
},
"execution_state": "executed",
"version": -1
},
"trigger_event": {
"type": "schedule",
"triggered_time": "2021-02-15T14:13:24.418Z",
"schedule": {
"scheduled_time": "2021-02-15T14:13:23.985Z"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"datasolutions-svc-*"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"filter": [
{
"term": {
"level": {
"value": "ERROR"
}
}
},
{
"terms": {
"servicename": [
"Iit.Det.service"
]
}
},
{
"range": {
"@timestamp": {
"gte": "now-10m"
}
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 0
}
}
},
"metadata": {
"name": "datasolutions-mepsubscriber",
"xpack": {
"type": "json"
}
},
"result": {
"execution_time": "2021-02-15T14:13:24.418Z",
"execution_duration": 8,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 4,
"failed": 0,
"successful": 4,
"skipped": 3
},
"hits": {
"hits": [],
"total": 0,
"max_score": null
},
"took": 6,
"timed_out": false
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"datasolutions-svc-*"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"filter": [
{
"term": {
"level": {
"value": "ERROR"
}
}
},
{
"terms": {
"servicename": [
"Iit.Det.service"
]
}
},
{
"range": {
"@timestamp": {
"gte": "now-10m"
}
}
}
]
}
}
}
}
}
},
"condition": {
"type": "compare",
"status": "success",
"met": true,
"compare": {
"resolved_values": {
"ctx.payload.hits.total": 0
}
}
},
"actions": [
{
"id": "my-logging-action",
"type": "logging",
"status": "success",
"logging": {
"logged_text": "There are 0 documents in your index. Threshold is 0."
}
}
]
},
"messages": []
}
Also, there are a few statuses here, which I am trying to understand, the first being, right on top which states my logging action is "ackable", and another being right down in the "result" section, stating the action status as "success". What do these 2 diff but conflicting statuses mean? Also, in the "result" section, I can see the logged text as "lThere are 0 documents in your index. Threshold is 0", why is it still in the firing mode then and not changing to OK?
EDIT 1: Is it because of the problem mentioned in this thread?
https://discuss.elastic.co/t/watcher-webhook-stays-in-firing-status/179965