Hi there,
I can't figure how t change timestamp timezone in watcher output I got .
Below is my watcher alert
{
"trigger": {
"schedule": {
"interval": "15m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"metricbeat*"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"must": [],
"filter": [
{
"query_string": {
"query": "*"
}
},
{
"match_phrase": {
"metricset.name": "event"
}
},
{
"match_phrase": {
"kubernetes.event.involved_object.kind": "Node"
}
},
{
"bool": {
"minimum_should_match": 1,
"should": [
{
"match_phrase": {
"kubernetes.event.reason": "NodeNotReady"
}
},
{
"match_phrase": {
"kubernetes.event.reason": "NodeReady"
}
}
]
}
},
{
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-15m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
},
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"size": 5
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"webhook_k8s_prod": {
"webhook": {
"scheme": "https",
"host": "discordapp.com",
"port": 443,
"method": "post",
"path": "api/webhooks/xxxxxx",
"params": {},
"headers": {},
"body": """{ "content": "{{ctx.metadata.name}} alert triggered at {{ctx.payload.calctime}} - There are {{ctx.payload.hits.total}} NodeReady/NotReady log message on last 15 minutes on k8s : \n\n{{#ctx.payload.hits.hits}} {{_source.@timestamp}} : {{_source.kubernetes.event.message}}\n{{/ctx.payload.hits.hits}}"}"""
}
}
},
"transform": {
"script": {
"source": "def payload = ctx.payload; payload.calctime = Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('Europe/Paris')).format(DateTimeFormatter.ofPattern('dd/MM/YYYY HH:mm')); return payload;",
"lang": "painless"
}
}
}
With transform script, I'm able to define payload.calctime, but I can't find the way to do the same with _source.@timestamp
fields, which looks like 2021-05-26T16:59:51.246Z
; I would like to have it in Europe/Paris
format
Any help would be appreciated
thanks