Watcher alert syntax error

[Alexandros888]

Hello,

I have the following watcher alert code.

I simply want to check if 2 specific messages (at least 1 out of 2) exist in the message field of a certain facility named: galaxus-service.

BUT i get the syntax error of image 1 while trying.

{
  "trigger": {
    "schedule": {
      "interval": "2m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "sag-gelf-logs-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query":
           {
            "bool": {
                "must": 
				[
                         {
                          "match": {
                          "facility": "galaxus-service"
                                   }
                         }
				],
               "filter": 
			   [
                        {
                          "range": {
                            "@timestamp": {
                              "gte": "now-100d"
                            }
                          }
                        }
				],
			   "should": [
			               "bool": 
						  {
                                 "should": [
                                {
                                  "match_phrase": {
                                  "message": "*an HttpOperationFailedException exception was raised:*"
                                                  }
                                },
								{
                                  "match_phrase": {
                                  "message": "*rejectOrderException was raised: 
	                                           com.sagag.fuse.edi4customers.exception.RejectOrderException"
                                                  }
                                }
								
                          ],
                          "minimum_should_match": 1
                        }
					  ]

                   }
                }
             }
          }
        }
       },
       "condition": {
       "compare": {
       "ctx.payload.hits.total": {
        "gt": 0
       }
      }
   }
 }

Why i get that syntax error ?

Thank you!

[AClerk]

@Alexandros888

...
				],
			   "should": [
			               "bool": 
...

-->

			   "should": [
			               "bool",

I dont know if your script is correct, but you have a JSON syntax issue.

[Alexandros888]

@Alexandros888

{
  "trigger": {
    "schedule": {
      "interval": "2m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "sag-gelf-logs-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query":
           {
            "bool": {
                "must": 
				[
                         {
                          "match": {
                          "facility": "galaxus-service"
                                   }
                         }
				],
               "filter": 
			   [
                        {
                          "range": {
                            "@timestamp": {
                              "gte": "now-100d"
                            }
                          }
                        }
				],
			   "should": [
			               "bool": 
						  {
                                 "should": [
                                {
                                  "match_phrase": {
                                  "message": "*an HttpOperationFailedException exception was raised:*"
                                                  }
                                },
								{
                                  "match_phrase": {
                                  "message": "*rejectOrderException was raised: 
	                                           com.sagag.fuse.edi4customers.exception.RejectOrderException"
                                                  }
                                }
								
                          ],
                          "minimum_should_match": 1
                        }
					  ]

                   }
                }
             }
          }
        }
       },
       "condition": {
       "compare": {
       "ctx.payload.hits.total": {
        "gt": 0
       }
      }
   }
 }

Hello AClerk. Thank you. But i still dont unerstand why it is wrong. I just have a a should statement within another should statement and in order to implement (a should within should) i have a bool statement between them.

 "should": [
			               "bool": 
						  {
                                 "should": [
                                {
                                  "match_phrase": {
                                  "message": "*an HttpOperationFailedException exception was raised:*"
                                                  }
                                },
								{
                                  "match_phrase": {
                                  "message": "*rejectOrderException was raised: 
	                                           com.sagag.fuse.edi4customers.exception.RejectOrderException"
                                                  }
                                }
								
                          ],
                          "minimum_should_match": 1
                        }
					  ]

Thank you