Watcher payload modification converts list to object

I create a watch,
The watch action transform tries to replace the payload.
I'm partially successful, but several items do not work as I expected

  1. The payload is replaced, but I want to create a list of name-value pairs. I can create a list if I only use names. Once I used name value pairs, I get an array. How do I create a list in the transform?

  2. When I try to print just the list, it gets turned into an object. Why is list important to me? Because I wish to use mustache to iterate over the list produced by the execution, and I don't know how to make mustache iterate over an object. Iterate over object key/value pairs? · Issue #457 · janl/mustache.js · GitHub.

Blockquote

DELETE _xpack/watcher/watch/alex_watch

PUT _xpack/watcher/watch/alex_watch
{
    "metadata" : {
        "name"                  : "DevOps Salt Minion Errors",
        "time_range"            : "now-2d"
    },
    "trigger": {  "schedule": { "interval": "30m" }  },
    "input": {
        "search": {
            "request": {
                "indices": ["salt-minion-*"],
               "body": {
                    "query": {
                        "bool": {
                           "must": [
                                { "range"    : { "@timestamp": { "gte": "{{ctx.metadata.time_range}}"  }  }  },
                                { "exists"   : { "field" : "text" } },
                                { "wildcard" : { "text" : "*failed*" } }
                            ]
                        }
                    },
                    "size" : 0,
                   "aggregations": { "by_text": { "terms": { "field": "text", "size": 2 } } }
                }
            }
        }
    },
   "condition": {  "compare": {  "ctx.payload.hits.total": {  "gt": 0  } } },
    "actions": {
        "send-to-anelson": {
            "throttle_period" : "1h",
            "transform": {
              "script": "return [ 'title':'froggies', 'mylist' : ['bug','sev2'] , 'yourlist' : [ '1':'one', '2':'two']  ] "  
            },
            "webhook" : {
           "method" : "POST",
            "url" : "https://hooks.slack.com/services/xxx",
            "headers" : { "Content-Type" : "application/json" },
            "body": "{ \"text\": \"  \npayload=>{{ctx.payload}},\nmylist=>{{ctx.payload.mylist}},\nyourlist={{ctx.payload.yourlist}}\n \" } "
           }
        }
    }
}
POST _xpack/watcher/watch/alex_watch/_execute

please take the time to properly format your message, this is nearly impossible to read. As you can use markdown here, this makes it easy to create good readable examples, which also increases the possibility of help.

Returning a list can be done by

def list = [] ; list.add(1); list.add(2); return list

If you do not return a map, you can access the created field using ctx.payload._value.

Printing a list just calls toString() on it, and returns its string representation. This is intended. If you want to do do something with each element of a list, then you have to iterate through it. Iteration is done by calling {{#ctx.payload.YOURLISTELEMENT}} here you do sth per element {{/ctx.payload.YOURLISTELEMENT}}

You should check out our alerting examples, check out the search template docs for some more mustache examples

Spinscale,

I tried to fix the markdown.
Thanks for your response, I now understand that it only looks like list->object when toString is used.
I have it working now.
Thanks!

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.