Watch history not written

Elastic Stack Elasticsearch
22

Hey,

this is fixed in in the 2.3.4 version of watcher, see the release notes https://www.elastic.co/guide/en/watcher/2.3/release-notes.html

--Alex

23

I've done an upgrade to 2.3.4, but no luck...

[2016-07-13 14:31:27,317][ERROR][watcher.execution        ] [******-esn00] failed to update watch record [url_nu.nl_2-2016-07-13T12:31:26.559Z]
MapperParsingException[Field name [trigger_event.triggered_time] cannot contain '.']

I forget about the last part:
Note that this just updates the template, so you
need to wait one day for this update to take effect when a new history index is
created

Let wait until tomorrow...

24

Hey,

If this is a test cluster you could delete the history index as well, otherwise waiting might be easier. if it does not work by tomorrow, please provide the whole failing watch, so I can try to reproduce the issue. Thanks!

--Alex

25

Hi,

I'm getting this problem on version 2.3.4 for chained queries. I included the watch, so hopefully the problem is reproducible.

I'm using a chained-query watcher to detect when a recently executed watch stops executing (i.e when the problem is fixed), but this problem is preventing me from finishing implementing the recovery alert.

I'm trying to detect whether a "recovery" watch alert was already sent, which requires me to get the watch-history for the chained watcher. (I'm doing this to prevent a recovery email isn't sent twice).

I'm currently on versions:

  • ElasticSearch 2.3.4
  • Watcher 2.3.4

and am getting the error:

[2017-01-09 13:08:39,920][ERROR][watcher.execution ] failed to update watch record [recovery_logstash_direct_heartbeat_xxxxxxx_dev_vm_logstash_cus_0_0-2017-01-09T13:08:39.857Z] MapperParsingException[Field name [ctx.payload.hits.total] cannot contain '.']

for the following watcher. Ignore the "awaits_successful_execution" message, as I've deleted / renamed this a few times; when using the execute API this watcher executed successfully, but it's watch-history record wasn't written.

Is there any advice anyone has for getting around this problem? Will upgrading to ElasticSearch 5.* and Watcher 5.* resolve this?

EDIT: Sorry, I read the changelog, which says this is fixed in 2.3.5. I'll upgrade, and test whether this is resolved