Watcher is not returning any hit and returns Null

Hi, I created one watcher but the condition is not getting successful and returning hit =0, and finally, it is returning a null value. When I built the dashboard using the same condition value is getting displayed there, I also checked in the Preformatted text discover tab, Value is there.

This is the O/P

{
  "_id" : "ab6c075c-1420-4826-b48b-c57b496e9eec_05ce93ef-c2cf-4245-8c9b-ca94cd5b5245-2021-07-14T14:03:30.068250852Z",
  "watch_record" : {
    "watch_id" : "ab6c075c-1420-4826-b48b-c57b496e9eec",
    "node" : "n-2CcZomQIWiklu2KWP19g",
    "state" : "execution_not_needed",
    "status" : {
      "state" : {
        "active" : true,
        "timestamp" : "2021-07-14T13:20:34.297Z"
      },
      "last_checked" : "2021-07-14T14:03:30.068Z",
      "actions" : {
        "netcool_webhook" : {
          "ack" : {
            "timestamp" : "2021-07-14T13:20:34.297Z",
            "state" : "awaits_successful_execution"
          }
        },
        "site_webhook" : {
          "ack" : {
            "timestamp" : "2021-07-14T13:20:34.297Z",
            "state" : "awaits_successful_execution"
          }
        }
      },
      "execution_state" : "execution_not_needed",
      "version" : 12
    },
    "trigger_event" : {
      "type" : "manual",
      "triggered_time" : "2021-07-14T14:03:30.068Z",
      "manual" : {
        "schedule" : {
          "scheduled_time" : "2021-07-14T14:03:30.068Z"
        }
      }
    },
    "input" : {
      "search" : {
        "request" : {
          "search_type" : "query_then_fetch",
          "indices" : [
            "4g-pm*"
          ],
          "rest_total_hits_as_int" : true,
          "body" : {
            "query" : {
              "bool" : {
                "filter" : [
                  {
                    "bool" : {
                      "must" : [
                        {
                          "range" : {
                            "pm_data_source.timestamp" : {
                              "gte" : "now-30d"
                            }
                          }
                        },
                        {
                          "wildcard" : {
                            "pm_data_source.dn" : "LNCEL"
                          }
                        }
                      ]
                    }
                  }
                ]
              }
            },
            "aggregations" : {
              "group_by_time" : {
                "date_histogram" : {
                  "field" : "pm_data_source.timestamp",
                  "fixed_interval" : "1h"
                },
                "aggs" : {
                  "sum_M8009C7" : {
                    "sum" : {
                      "field" : "pm_data.LTE_Intra_eNB_HO_M8009C7"
                    }
                  },
                  "sum_M8009C2" : {
                    "sum" : {
                      "field" : "pm_data.LTE_Intra_eNB_HO_M8009C2"
                    }
                  },
                  "LTE_5043a" : {
                    "bucket_script" : {
                      "buckets_path" : {
                        "M8009C7" : "sum_M8009C7",
                        "M8009C2" : "sum_M8009C2"
                      },
                      "script" : "((100 * (params.M8009C7)) / (params.M8009C2))"
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "condition" : {
      "compare" : {
        "ctx.payload.hits.total" : {
          "gt" : 0
        }
      }
    },
    "metadata" : {
      "name" : "LTE_5043a:E-UTRAN Total HO Success Ratio, intra eNB",
      "xpack" : {
        "type" : "json"
      }
    },
    "result" : {
      "execution_time" : "2021-07-14T14:03:30.068Z",
      "execution_duration" : 42,
      "input" : {
        "type" : "search",
        "status" : "success",
        "payload" : {
          "_shards" : {
            "total" : 190,
            "failed" : 0,
            "successful" : 190,
            "skipped" : 64
          },
          "hits" : {
            "hits" : [ ],
            "total" : 0,
            "max_score" : null
          },
          "took" : 42,
          "timed_out" : false,
          "aggregations" : {
            "group_by_time" : {
              "buckets" : [ ]
            }
          }
        },
        "search" : {
          "request" : {
            "search_type" : "query_then_fetch",
            "indices" : [
              "4g-pm*"
            ],
            "rest_total_hits_as_int" : true,
            "body" : {
              "query" : {
                "bool" : {
                  "filter" : [
                    {
                      "bool" : {
                        "must" : [
                          {
                            "range" : {
                              "pm_data_source.timestamp" : {
                                "gte" : "now-30d"
                              }
                            }
                          },
                          {
                            "wildcard" : {
                              "pm_data_source.dn" : "LNCEL"
                            }
                          }
                        ]
                      }
                    }
                  ]
                }
              },
              "aggregations" : {
                "group_by_time" : {
                  "date_histogram" : {
                    "field" : "pm_data_source.timestamp",
                    "fixed_interval" : "1h"
                  },
                  "aggs" : {
                    "sum_M8009C7" : {
                      "sum" : {
                        "field" : "pm_data.LTE_Intra_eNB_HO_M8009C7"
                      }
                    },
                    "sum_M8009C2" : {
                      "sum" : {
                        "field" : "pm_data.LTE_Intra_eNB_HO_M8009C2"
                      }
                    },
                    "LTE_5043a" : {
                      "bucket_script" : {
                        "buckets_path" : {
                          "M8009C7" : "sum_M8009C7",
                          "M8009C2" : "sum_M8009C2"
                        },
                        "script" : "((100 * (params.M8009C7)) / (params.M8009C2))"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      },
      "condition" : {
        "type" : "compare",
        "status" : "success",
        "met" : false,
        "compare" : {
          "resolved_values" : {
            "ctx.payload.hits.total" : 0
          }
        }
      },
      "actions" : [ ]
    },
    "messages" : [ ]
  }
}

This is the watcher config

{
  "trigger": {
    "schedule": {
      "interval": "1d"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "4g-pm*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "filter": [
                {
                  "bool": {
                    "must": [
                      {
                        "range": {
                          "pm_data_source.timestamp": {
                            "gte": "now-30d"
                          }
                        }
                      },
                      {
                        "wildcard": {
                          "pm_data_source.dn": "LNCEL"
                        }
                      }
                    ]
                  }
                }
              ]
            }
          },
          "aggregations": {
            "group_by_time": {
              "date_histogram": {
                "field": "pm_data_source.timestamp",
                "fixed_interval": "1h"
              },
              "aggs": {
                "sum_M8009C7": {
                  "sum": {
                    "field": "pm_data.LTE_Intra_eNB_HO_M8009C7"
                  }
                },
                "sum_M8009C2": {
                  "sum": {
                    "field": "pm_data.LTE_Intra_eNB_HO_M8009C2"
                  }
                },
                "LTE_5043a": {
                  "bucket_script": {
                    "buckets_path": {
                      "M8009C7": "sum_M8009C7",
                      "M8009C2": "sum_M8009C2"
                    },
                    "script": "((100 * (params.M8009C7)) / (params.M8009C2))"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "actions": {
    "site_webhook": {
      "webhook": {
        "scheme": "https",
        "host": "webhook.site",
        "port": 443,
        "method": "post",
        "path": "/8e84037f-08ce-48ec-853e-e995db7863d0",
        "params": {
          "watch_id": "{{ctx.watch_id}}"
        },
        "headers": {
          "Content-type": "application/json"
        },
        "body": "{{#toJson}}ctx.payload{{/toJson}}"
      }
    },
    "netcool_webhook": {
      "webhook": {
        "scheme": "http",
        "host": "169.50.105.193",
        "port": 10073,
        "method": "post",
        "path": "multicloudmanagedservices.ibm.com",
        "params": {
          "count": "{{ctx.payload.hits.total}}",
          "watch_id": "{{ctx.watch_id}}"
        },
        "headers": {
          "Content-type": "application/json"
        },
        "body": "{{#toJson}}ctx.payload{{/toJson}}"
      }
    }
  },
  "transform": {
    "script": {
      "source": """ 
             String get_remarks(double x){
               if(x >= 99){
                     return 'Good'
                   } else if(x == 98){
                     return 'Average'
                   } else {
                     return 'Poor'
                   }
             }
             BigDecimal round_to_decimal(double x){
               return (BigDecimal.valueOf(x).setScale(2, RoundingMode.HALF_UP))
             }
             return [
              'documents':ctx.payload.aggregations.group_by_time.buckets.stream()
                .map(t -> { return [
                   'Client_name': 'Nokia',
                   'Metric Name': 'E-UTRAN Total HO Success Ratio, intra eNB',
                   'ALert Description': 'E-UTRAN Average',
                   'Timestamp': t.key_as_string,
                   'Remarks': get_remarks(t.LTE_5043a.value),
                   'Total HO Success Ratio, intra eNB - LTE_5043a(%)': t.LTE_5043a.value
                  ] }).collect(Collectors.toList())
              ]
              """,
      "lang": "painless"
    }
  }
}

Is the user, that you stored the watch as (at the time the watch was stored) allowed to read all the indices from a security perspective?

Yes, It has access. There is no security concern. What can be the possible reason? I am also wondering how this weird behaviour is showing?

@spinscale Please help to fix this issue. I have been stuck with this issue and I am exhausted with options.

Please keep in mind that this is a completely voluntary run forum without any SLAs. If you need commercial support, that answers within a certain time, you can buy it :slight_smile:

You have not answered my question above regarding the access when the watch was stored. Is that still true?

What happens when you run the Execute Watch API in dev-tools? Does that execute as expected? Can you share the output? If you specify the whole watch as part of the execute watch API instead of specifying its name - does the output stay the same?

How did you store this watch? Within dev-tools or with another process? Trying to find the way how this has happened...

So , When I execute like this

#LTE_5043a
POST /_watcher/watch/ab6c075c-1420-4826-b48b-c57b496e9eec/_execute

The output is coming like - see below

{
  "_id" : "ab6c075c-1420-4826-b48b-c57b496e9eec_ebba1052-49f0-4f06-bb59-cb53c0c97c2a-2021-07-19T10:19:52.637105885Z",
  "watch_record" : {
    "watch_id" : "ab6c075c-1420-4826-b48b-c57b496e9eec",
    "node" : "n-2CcZomQIWiklu2KWP19g",
    "state" : "execution_not_needed",
    "status" : {
      "state" : {
        "active" : true,
        "timestamp" : "2021-07-14T13:20:34.297Z"
      },
      "last_checked" : "2021-07-19T10:19:52.637Z",
      "actions" : {
        "netcool_webhook" : {
          "ack" : {
            "timestamp" : "2021-07-14T13:20:34.297Z",
            "state" : "awaits_successful_execution"
          }
        },
        "site_webhook" : {
          "ack" : {
            "timestamp" : "2021-07-14T13:20:34.297Z",
            "state" : "awaits_successful_execution"
          }
        }
      },
      "execution_state" : "execution_not_needed",
      "version" : 15
    },
    "trigger_event" : {
      "type" : "manual",
      "triggered_time" : "2021-07-19T10:19:52.637Z",
      "manual" : {
        "schedule" : {
          "scheduled_time" : "2021-07-19T10:19:52.637Z"
        }
      }
    },
    "input" : {
      "search" : {
        "request" : {
          "search_type" : "query_then_fetch",
          "indices" : [
            "4g-pm*"
          ],
          "rest_total_hits_as_int" : true,
          "body" : {
            "query" : {
              "bool" : {
                "filter" : [
                  {
                    "bool" : {
                      "must" : [
                        {
                          "range" : {
                            "pm_data_source.timestamp" : {
                              "gte" : "now-30d"
                            }
                          }
                        },
                        {
                          "wildcard" : {
                            "pm_data_source.dn" : "LNCEL"
                          }
                        }
                      ]
                    }
                  }
                ]
              }
            },
            "aggregations" : {
              "group_by_time" : {
                "date_histogram" : {
                  "field" : "pm_data_source.timestamp",
                  "fixed_interval" : "1h"
                },
                "aggs" : {
                  "sum_M8009C7" : {
                    "sum" : {
                      "field" : "pm_data.LTE_Intra_eNB_HO_M8009C7"
                    }
                  },
                  "sum_M8009C2" : {
                    "sum" : {
                      "field" : "pm_data.LTE_Intra_eNB_HO_M8009C2"
                    }
                  },
                  "LTE_5043a" : {
                    "bucket_script" : {
                      "buckets_path" : {
                        "M8009C7" : "sum_M8009C7",
                        "M8009C2" : "sum_M8009C2"
                      },
                      "script" : "((100 * (params.M8009C7)) / (params.M8009C2))"
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "condition" : {
      "compare" : {
        "ctx.payload.hits.total" : {
          "gt" : 0
        }
      }
    },
    "metadata" : {
      "name" : "LTE_5043a:E-UTRAN Total HO Success Ratio, intra eNB",
      "xpack" : {
        "type" : "json"
      }
    },
    "result" : {
      "execution_time" : "2021-07-19T10:19:52.637Z",
      "execution_duration" : 43,
      "input" : {
        "type" : "search",
        "status" : "success",
        "payload" : {
          "_shards" : {
            "total" : 190,
            "failed" : 0,
            "successful" : 190,
            "skipped" : 64
          },
          "hits" : {
            "hits" : [ ],
            "total" : 0,
            "max_score" : null
          },
          "took" : 43,
          "timed_out" : false,
          "aggregations" : {
            "group_by_time" : {
              "buckets" : [ ]
            }
          }
        },
        "search" : {
          "request" : {
            "search_type" : "query_then_fetch",
            "indices" : [
              "4g-pm*"
            ],
            "rest_total_hits_as_int" : true,
            "body" : {
              "query" : {
                "bool" : {
                  "filter" : [
                    {
                      "bool" : {
                        "must" : [
                          {
                            "range" : {
                              "pm_data_source.timestamp" : {
                                "gte" : "now-30d"
                              }
                            }
                          },
                          {
                            "wildcard" : {
                              "pm_data_source.dn" : "LNCEL"
                            }
                          }
                        ]
                      }
                    }
                  ]
                }
              },
              "aggregations" : {
                "group_by_time" : {
                  "date_histogram" : {
                    "field" : "pm_data_source.timestamp",
                    "fixed_interval" : "1h"
                  },
                  "aggs" : {
                    "sum_M8009C7" : {
                      "sum" : {
                        "field" : "pm_data.LTE_Intra_eNB_HO_M8009C7"
                      }
                    },
                    "sum_M8009C2" : {
                      "sum" : {
                        "field" : "pm_data.LTE_Intra_eNB_HO_M8009C2"
                      }
                    },
                    "LTE_5043a" : {
                      "bucket_script" : {
                        "buckets_path" : {
                          "M8009C7" : "sum_M8009C7",
                          "M8009C2" : "sum_M8009C2"
                        },
                        "script" : "((100 * (params.M8009C7)) / (params.M8009C2))"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      },
      "condition" : {
        "type" : "compare",
        "status" : "success",
        "met" : false,
        "compare" : {
          "resolved_values" : {
            "ctx.payload.hits.total" : 0
          }
        }
      },
      "actions" : [ ]
    },
    "messages" : [ ]
  }
}

I created and stored the watcher by going to the watcher option and then I choose
create advanced watch.

The important response part is this

"condition" : {
        "type" : "compare",
        "status" : "success",
        "met" : false,
        "compare" : {
          "resolved_values" : {
            "ctx.payload.hits.total" : 0
          }
        }
      }

As already mentioned, there is no data returned. Just for the sake of example, if you change the query to a match_all query, does the execute watch output turn in the condition in a successful result?

@spinscale I figured out the issue, the issue was because of capital "LNCEL".
BTW thanks for your time and help.

1 Like