I'm doing an index action in my watch's Actions block for docs from a _doc payload (see code below). Index action works fine, however, I have duplicate docs and haven't figured out how to evaluate the "doc_id" value in a dynamic way within my index action given a "_doc" payload source:
"actions" : {
"index_matches" : {
"transform" : {
"chain": [
{
"search" : {
"request" : {
"indices" : "rq-snow",
"body" : {
"size": 1000000,
"query" : {
"match" : {
"ip": "{{#ctx.payload.hits.hits}} {{_source.ip}} {{/ctx.payload.hits.hits}}"
}
}
}
}
}
},
{
"script": {
"inline": "def document = []; for(item in ctx.payload.hits.hits) {document.add(item._source);} return [ \"_doc\" : document ];"
}
}
]
},
"index" : {
"index" : "rq-snow-aware",
"doc_type" : "Hit",
}
}
}