Watcher: comparing two fields from different indexes

Elastic Stack Elasticsearch
1

Hi, Im running a chained input watch with two queries: "first" and "second", and comparing the fields partition_field_value from "first" against hostname from "second", Im certain that in both indexes exist a partition_field_value with the same value as a hostname, but I keep getting this error:

              "type" : "script_exception",
              "reason" : "runtime error",
              "script_stack" : [
                "java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64)",
                "java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70)",
                "java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:248)",
                "java.base/java.util.Objects.checkIndex(Objects.java:373)",
                "java.base/java.util.ArrayList.get(ArrayList.java:425)",
                "if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) { ",
                "                               ^---- HERE"
              ],

The weird thing is that my condition works and its almost the same code that is in the transform

    "condition": {
      "script": {
        "source": "for (int i = 0; i < ctx.payload.second.hits.total; ++i) { 
                                if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) { return true;}
                         }",
        "lang": "painless"
      }
    },
    "actions": {
      "my-logging-action": {
        "transform": {
          "script": {
            "source": "ctx.payload.transform = []; 
                       def document = []; 
                       for (int i = 0; i < ctx.payload.second.hits.total; ++i) { 
                          if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) {
                             document = ['hostname': ctx.payload.second.hits.hits[i]._source.hostname]; 
                             ctx.payload.transform.add(document) 
                          }
                       } return ctx.payload.transform;",
            "lang": "painless"
          }
        },
        "logging": {
          "level": "warn",
          "text": "true match {{#ctx.payload._value}} {{hostname}} {{/ctx.payload._value}}"
        }
      }
    }

When I do both queries outside the watcher, they both return results
What is wrong with my transform script?

2

I have changed the condition in the for loop on the transform, and now doesnt throw any errors

from this:

for (int i = 0; i < ctx.payload.second.hits.total; ++i)

to this:

 for (int i = 0; i < ctx.payload.second.hits.hits.size(); ++i)

Now I have two doubts, they both get the same number? getting the total of hits from the query field total, and using the function size()?

and why , getting the total in the condition works, but doesnt in the transform?

3

The size of the hits array depends on the number of documents returned that is set by the size parameter.

1 Like
4

Hi, I have no size parameter in my queries.

5

It defaults to 10.. also you cannot make it arbitrary big, so you probably will not compare all of your indexed data.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.