Watcher Condition Returning "Null"

Elastic Stack Elasticsearch
1

Hi everyone,

My condition is currently returning "null", however I know there are documents.
Can you please help me in figuring out why it's returning "null"?

// My watcher code thus far:

// Stimulated results output

Thank you in advanced :slight_smile:

2

the addressing scheme of your condition is wrong. Your condition is

ctx.payload.aggregations.managedobjectref.timerange.buckets.0.doc_count

the first part ctx.payload.aggregations.managedobjectref is correct, however before reaching the timerange field, you missed that there is a buckets array where each element contains a timerange field.

3

Thanks for replying @spinscale :slight_smile:

I realised that yesterday, however I am still getting "null".

//This is the output I am getting now.

// This is my console

4

this snippet

"ctx.payload.aggregations.managedobjectref.buckets.timerange.buckets.doc_count": {

does access the array, but does not take the element position into account like buckets.0. for the first element

5

So it should be
"ctx.payload.aggregations.managedobjectref.buckets.timerange.buckets.0.doc_count"

which takes the element position starting from 0?

6

please look at the data more closely. You will see that there are two buckets fields, and each of them is an array, so you need to use an index twice.

7

Yes, I just did that and got the answer

Thank you so much @spinscale
Really appreciate your help on this one :slight_smile:

Answer for future readers:
"ctx.payload.aggregations.<first_agg>.buckets.0.<second_agg>.buckets.0.<field>"

// Example:
"ctx.payload.aggregations.managedobjectref.buckets.0.timerange.buckets.0.doc_count"
Note: This is when there is only ONE array

8

Hi @spinscale,

Following on from this, what if I wanted to look at all the arrays, not just Array 0?

Thanks,
Nhung

9

the you need use a script condition instead of the compare one, which allows you to walk through all the buckets.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.