Watcher not work perfect

Elastic Stack Elasticsearch
,
1

i have some aggs like this:

      "aggregations" : {
    "range_by_date" : {
      "buckets" : [
        {
          "key" : "2020-10-04T06:27:06.912Z-*",
          "from" : 1.601792826912E12,
          "from_as_string" : "2020-10-04T06:27:06.912Z",
          "doc_count" : 38,
          "fooo" : {
            "doc_count_error_upper_bound" : 0,
            "sum_other_doc_count" : 0,
            "buckets" : [
              {
                "key" : "001",
                "doc_count" : 2,
                "drop" : {
                  "value" : 1
                }
    },{
                "key" : "002",
                "doc_count" : 2,
                "drop" : {
                  "value" : 2
                }
    },{
                "key" : "003",
                "doc_count" : 2,
                "drop" : {
                  "value" : 5
                }
    },{
                "key" : "004",
                "doc_count" : 2,
                "drop" : {
                  "value" : 0
                }
    },{
                "key" : "005",
                "doc_count" : 2,
                "drop" : {
                  "value" : 0
                }
    },{
                "key" : "006",
                "doc_count" : 2,
                "drop" : {
                  "value" : 0
                }
    },{
                "key" : "007",
                "doc_count" : 2,
                "drop" : {
                  "value" : 1
                }
    }{
                "key" : "008",
                "doc_count" : 2,
                "drop" : {
                  "value" : 2
                }
    }{
                "key" : "009",
                "doc_count" : 2,
                "drop" : {
                  "value" : 1
                }
    }{
                "key" : "020",
                "doc_count" : 2,
                "drop" : {
                  "value" : 5
                }
    },{
                "key" : "021",
                "doc_count" : 2,
                "drop" : {
                  "value" : 2
                }
    }]
    }}]}}

in my condition:

    ctx.payload.errors = [];
    ctx.payload.values = ctx.payload.aggregations.range_by_date.buckets[0].fooo.buckets;
    for(x in ctx.payload.values) {
      if(x.drop.value > 2) {
        ctx.payload.errors.add(x.key);
    }
    }

when i log ctx.payload.errors in Log Action i see only "003"
however i expect "003, 020"
why this happen?

2

please share your whole watch or the output of the execute watch Api, as it contains the search response. Also you can try to run Debug.explain(ctx.payload.values) in your condition, which throws an exception but contains information about that data structure for further debugging.

From a 10000 foot view this looks correct and the other bucket should be included as well, but maybe seeing all the detail will reveal something.

3

i do this and in ctx.payload.values i see 020 key! but in elastic log file it was only 003

4

We can use the Execute Watch API for a debugging session.

POST _watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
      }
    },
    "input": {
      "simple": {
        "aggregations": {
          "range_by_date": {
            "buckets": [
              {
                "key": "2020-10-04T06:27:06.912Z-*",
                "from": 1601792826912,
                "from_as_string": "2020-10-04T06:27:06.912Z",
                "doc_count": 38,
                "fooo": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                    {
                      "key": "001",
                      "doc_count": 2,
                      "drop": {
                        "value": 1
                      }
                    },
                    {
                      "key": "002",
                      "doc_count": 2,
                      "drop": {
                        "value": 2
                      }
                    },
                    {
                      "key": "003",
                      "doc_count": 2,
                      "drop": {
                        "value": 5
                      }
                    },
                    {
                      "key": "004",
                      "doc_count": 2,
                      "drop": {
                        "value": 0
                      }
                    },
                    {
                      "key": "005",
                      "doc_count": 2,
                      "drop": {
                        "value": 0
                      }
                    },
                    {
                      "key": "006",
                      "doc_count": 2,
                      "drop": {
                        "value": 0
                      }
                    },
                    {
                      "key": "007",
                      "doc_count": 2,
                      "drop": {
                        "value": 1
                      }
                    },
                    {
                      "key": "008",
                      "doc_count": 2,
                      "drop": {
                        "value": 2
                      }
                    },
                    {
                      "key": "009",
                      "doc_count": 2,
                      "drop": {
                        "value": 1
                      }
                    },
                    {
                      "key": "020",
                      "doc_count": 2,
                      "drop": {
                        "value": 5
                      }
                    },
                    {
                      "key": "021",
                      "doc_count": 2,
                      "drop": {
                        "value": 2
                      }
                    }
                  ]
                }
              }
            ]
          }
        }
      }
    },
    "condition": {
      "script": """
ctx.payload.errors = [];
    ctx.payload.values = ctx.payload.aggregations.range_by_date.buckets[0].fooo.buckets;
    for(x in ctx.payload.values) {
      if(x.drop.value > 2) {
        ctx.payload.errors.add(x.key);
    }
    }
    return true;
      """
    },
    "actions": {
      "logme": {
        "logging": {
          "text": "{{ctx.payload.errors}}"
        }
      }
    }
  }
}

If you run this, you can see both fields being returned properly. This is why I would like to see either the watch history output or the execute watch api of that particular watch, otherwise everything else is just guesswork and won't get us to the solution.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.