Watcher action logging when condition array_compare

[Jo_De_Troy]

Hello,

I've created a watch with a search creating buckets and an array_compare condition.
I'd like to have an action that logs only the array elements where the condition is met.
Like below:
"condition": {
"array_compare": {
"ctx.payload.aggregations.by_host.buckets": {
"path": "averageResponseDuration",
"gt": {
"value": "200.",
"quantifier": "some"
}
}
}
},
"actions": {
"my-logging-action": {
"logging": {
"level": "info",
"text": "For {{ctx.payload.aggregations.by_host.buckets.key}} averageresponseDuration in too high. Threshold is 200."
}
}
}

But I don't know how I need to write the action logging text to only show the elements of the buckets that meet the condition, What is the best way to get this? Are there any alternatives possible?

Thx
Jo

[spinscale (Alexander Reelsen)]

Two possibilities: First you write a script transform in the watch, that filters for those buckets. Or, second, you write a bucket_selector pipeline aggregation, see https://www.elastic.co/guide/en/elasticsearch/reference/6.3/search-aggregations-pipeline-bucket-selector-aggregation.html#search-aggregations-pipeline-bucket-selector-aggregation