Watcher multiple conditions for nested buckets

Elastic Stack Elasticsearch
1

Hi !
I have many buckets and nested up to two buckets inside each of them. I want to iterate thru all of the buckets and check whether each of bucket's value is greater (for each bucket threshold is different).
It means I need two "OR" conditions. I have tried "array_compare" :{ "array_compare" : {} } but it looks like it is not allowed.

     "aggregations": {
        "last_day": {
          "doc_count": 4431,
          "time": {
            "buckets": [
              {
                "key_as_string": "2018-07-01T08:29:00.000Z",
                "doc_count": 3,
                "component": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "doc_count": 3,
                      "key": "ui"
                    }
                  ]
                },
                "key": 1530433740000
              },
              {
                "key_as_string": "2018-07-01T08:30:00.000Z",
                "doc_count": 3,
                "component": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "doc_count": 3,
                      "key": "ui"
                    }
                  ]
                },
                "key": 1530433800000
              },

Want to set one condition for 'ui' and another for 'service'.

2

If you want to to compare more than one field, you need to use a painless script and the script condition.

--Alex

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.