Watcher Alert on Agg Field & Painless Script Condition Error

Elastic Security
1

Hello everyone,
My goal of the Watcher is to fire when the unique count of hosts, from the hostname field drops below 110.

I have tried both .value and .doc_count in the script portion of the condition but still get the same error.

"return ctx.payload.aggregations.machine_count.buckets.0.value < params.threshold"

"return ctx.payload.aggregations.machine_count.buckets.0.doc_count < params.threshold"

Below is the error I am receiving and full Watcher text.

Error Received:

"caused_by" : {
        "type" : "null_pointer_exception",
        "reason" : """Cannot invoke "Object.getClass()" because "callArgs[0]" is null""",
        "stack_trace" : """java.lang.NullPointerException: Cannot invoke "Object.getClass()" because "callArgs[0]" is null

Watcher:
PUT _watcher/watch/_execute

{
"watch": {
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "Index Name"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "_source": "hostname",
          "query": {
            "bool": {
              "must": [],
              "must_not": [
              ],
              "filter": [
                {
                  "term": {
                    "tags": "hostType"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-5m",
                      "to": "now"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "machine_count": {
              "cardinality": {
                "field": "hostname"
              },
              "meta": {
                "name": "UNIQUE_MACHINE_AGG_RESULTS"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.machine_count.buckets.0.value < params.threshold",
      "lang": "painless",
      "params": {
        "threshold": 110
      }
    }
  },
  "actions": {
    "email_alert": {
      "email": {
        "profile": "standard",
        "to": [
          "Email address"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "html": ""
        }
      }
    }  
  }
}
}
2

Hey there @jc034240, I think you might want the Elasticsearch forums instead of this one?
https://discuss.elastic.co/tag/stack-alerting

We do mostly the detection engine which is separate and the reason why I think you're not going to get many replies on this part of the forums