Watcher document

Elastic Stack Elasticsearch
1

Hello Team,

I want to show value of a document if there is hits . Below is the watcher script

{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logs-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "should": [
                {
                  "term": {
                    "client_ip.keyword": {
                      "value": "10.0.0.9"
                    }
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1h",
                      "lte": "now"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "There are {{ctx.payload.hits.total}} hits and the value is {{ctx.payload.result.0.value"}}
      }
    }
  }
}

But i am getting only hits and not getting value.

2

Hello @Aniket_Pant

  1. Typo in your action i.e. quotes are before }} it should be after }}

"text": "There are {{ctx.payload.hits.total}} hits and the value is {{ctx.payload.result.0.value"}}

to

"text": "There are {{ctx.payload.hits.total}} hits and the value is {{ctx.payload.result.0.value}}"

  1. For size = 0 we have below values :
{{ctx.payload.hits.total}} is 244 hits 
{{ctx.payload}} is {_shards={total=1, failed=0, successful=1, skipped=0}, hits={hits=[], total=244, max_score=null}, took=0, timed_out=false}
  1. If you want to extract the value size = 5 (will extract 5 documents)

Use below
{{#ctx.payload.hits.hits}}{{_source.clientip}}, {{/ctx.payload.hits.hits}}

In my case field name is "clientip"

Values extracted :

"logged_text": "There are 244 hits and the values are 132.186.182.124, 132.186.182.124, 132.186.182.124, 132.186.182.124, 132.186.182.124, "

Thanks!!