found it!!! You beat me... that is because the aggregation is not inside the "hits" we need to be explicit with the field name
In the condition.
"condition": {
"compare": {
"ctx.payload.aggregations.heartbeat_count.value": {
"gte": 1000
}
}
}
And Action should be
"actions": {
"notify-slack": {
"slack": {
"message": {
"to": [
"#stephenb-es-integration"
],
"text": "Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day (facepalm)"
}
}
}
}
}
I will fix above!
Results
{
"watch_id": "_inlined_",
"node": "6FBy_sIiSGONVnQZ5O8GkA",
"state": "executed",
"user": "elastic",
"status": {
"state": {
"active": true,
"timestamp": "2021-04-23T23:35:37.938Z"
},
"last_checked": "2021-04-23T23:35:37.938Z",
"last_met_condition": "2021-04-23T23:35:37.938Z",
"actions": {
"notify-slack": {
"ack": {
"timestamp": "2021-04-23T23:35:37.938Z",
"state": "ackable"
},
"last_execution": {
"timestamp": "2021-04-23T23:35:37.938Z",
"successful": true
},
"last_successful_execution": {
"timestamp": "2021-04-23T23:35:37.938Z",
"successful": true
}
}
},
"execution_state": "executed",
"version": -1
},
"trigger_event": {
"type": "manual",
"triggered_time": "2021-04-23T23:35:37.938Z",
"manual": {
"schedule": {
"scheduled_time": "2021-04-23T23:35:37.938Z"
}
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"heartbeat-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-1d/d",
"lt": "now/d"
}
}
}
]
}
},
"aggs": {
"heartbeat_count": {
"value_count": {
"field": "_index"
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.aggregations.heartbeat_count.value": {
"gte": 1000
}
}
},
"metadata": {
"name": "test-heartbeat-watcher",
"xpack": {
"type": "json"
}
},
"result": {
"execution_time": "2021-04-23T23:35:37.938Z",
"execution_duration": 262,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 11,
"failed": 0,
"successful": 11,
"skipped": 0
},
"hits": {
"hits": [],
"total": 10000,
"max_score": null
},
"took": 14,
"timed_out": false,
"aggregations": {
"heartbeat_count": {
"value": 60474
}
}
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"heartbeat-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-1d/d",
"lt": "now/d"
}
}
}
]
}
},
"aggs": {
"heartbeat_count": {
"value_count": {
"field": "_index"
}
}
}
}
}
}
},
"condition": {
"type": "compare",
"status": "success",
"met": true,
"compare": {
"resolved_values": {
"ctx.payload.aggregations.heartbeat_count.value": 60474
}
}
},
"actions": [
{
"id": "notify-slack",
"type": "slack",
"status": "success",
"slack": {
"account": "monitoring",
"sent_messages": [
{
"status": "success",
"to": "#stephenb-es-integration",
"message": {
"from": "x-pack",
"icon": "http://example.com/images/watcher-icon.jpg",
"text": "Encountered 60474 heartbeats in the last 1 day (facepalm)"
}
}
]
}
}
]
},
"messages": []
}
La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas 60474
Hora:
Mensaje Alerta: Por favor no responder a este mensaje
)