Watcher: comparing two fields from different indexes

Hi, Im running a chained input watch with two queries: "first" and "second", and comparing the fields partition_field_value from "first" against hostname from "second", Im certain that in both indexes exist a partition_field_value with the same value as a hostname, but I keep getting this error:

              "type" : "script_exception",
              "reason" : "runtime error",
              "script_stack" : [
                "if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) { ",
                "                               ^---- HERE"

The weird thing is that my condition works and its almost the same code that is in the transform

    "condition": {
      "script": {
        "source": "for (int i = 0; i <; ++i) { 
                                if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) { return true;}
        "lang": "painless"
    "actions": {
      "my-logging-action": {
        "transform": {
          "script": {
            "source": "ctx.payload.transform = []; 
                       def document = []; 
                       for (int i = 0; i <; ++i) { 
                          if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) {
                             document = ['hostname': ctx.payload.second.hits.hits[i]._source.hostname]; 
                       } return ctx.payload.transform;",
            "lang": "painless"
        "logging": {
          "level": "warn",
          "text": "true match {{#ctx.payload._value}} {{hostname}} {{/ctx.payload._value}}"

When I do both queries outside the watcher, they both return results
What is wrong with my transform script?

I have changed the condition in the for loop on the transform, and now doesnt throw any errors

from this:

for (int i = 0; i <; ++i)

to this:

 for (int i = 0; i < ctx.payload.second.hits.hits.size(); ++i) 

Now I have two doubts, they both get the same number? getting the total of hits from the query field total, and using the function size()?

and why , getting the total in the condition works, but doesnt in the transform?

The size of the hits array depends on the number of documents returned that is set by the size parameter.

1 Like

Hi, I have no size parameter in my queries.

It defaults to 10.. also you cannot make it arbitrary big, so you probably will not compare all of your indexed data.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.