Watcher, action transform, Help getting "value" from this response

Elastic Stack Elasticsearch
1

I want to alert on error_percent > 9, but I don't know how to reference value under the field in the response.
transactioncount,
errorcount,
error_percent

Can someone help?

Below is the response from my aggregation search,
"aggregations": {
"project": {
"doc_count_error_upper_bound": 10,
"sum_other_doc_count": 474,
"buckets": [
{
"key": "RETTransaction-OP_R1-N1-tst03-1_root",
"doc_count": 2684,
"errorcount-bucket": {
"buckets": {
"Errors": {
"doc_count": 2684
}
}
},
"transactioncount-bucket": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "RETTransaction-OP_R1-N1-tst03-1_root",
"doc_count": 2684
}
]
},
"transactioncount": {
"value": 2684
},
"errorcount": {
"value": 2684
},
"error_percent": {
"value": 100
}
},
{
"key": "CustomerCommunication_SendComm_v4_root",
"doc_count": 1405,
"errorcount-bucket": {
"buckets": {
"Errors": {
"doc_count": 1405
}
}
},
"transactioncount-bucket": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "CustomerCommunication_SendComm_v4_root",
"doc_count": 1405
}
]
},
"transactioncount": {
"value": 1405
},
"errorcount": {
"value": 1405
},
"error_percent": {
"value": 100
}
}

2

There are two error_percent fields in your response.

A specific one could be access via ctx.payload.aggregations.project.buckets.0.error_percent or ctx.payload.aggregations.project.buckets.1.error_percent

There are a couple of solutions now. First you could loop over all the results and find the minimum value. Second you could use a min_bucket pipeline agg to get the minimal value and only compare that one.

Hope this helps.

3

I finally got it. Problem is the admins put a clunky we front end on watcher which outputs nothing if there is any error, making it very hard to troubleshoot.
This works:
"transform": {
"script": {
"inline": "ctx.payload.aggregations.project.buckets.stream().filter(it -> it.Error_Percent.value > 9).map(it -> ['project_name':it.key,'err_percent':Math.round(it.Error_Percent.value),'errcount':Math.round(it.errorcount.value),'transcount':Math.round(it.transactioncount.value)]).collect(Collectors.toList());",
"lang": "painless"
}
},
...
then I can alert slack
"text": "Below Engines have errors.\n{{#ctx.payload._value}}Project Name: {{project_name}}\tError Percent: {{err_percent}}%\tTransaction Count: {{transcount}}\tError Count: {{errcount}}\n{{/ctx.payload._value}}",

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.