Watcher: transform

Elastic Stack Elasticsearch
1

I want to use the transform section in watcher before action and wanted additional field to be added to the current payload. When I use the following painless script before the action I am getting only the epochtime in action and the original payload being lost. How to append the following epochtime to the ctx.payload so that I can access both.

"transform": {
"script": {
"inline": "return [ 'epochtime' : ctx.execution_time.getMillis() ]",
"lang": "painless"
}
},

2

the returned data is replaced by the payload, which means you need to include the existing payload, something like this (untested, on top of my head)

def payload = ctx.payload; payload.epochtime = ... ; return payload;

--Alex

2 Likes
3

Great. I will check this out.

4

It works. Thanks. But when I add some more code (replaceAll()). I am not able to save the watcher. I see the following error.

Watcher: An internal server error occurred

"transform": {
"script": {
"inline": "def payload = ctx.payload; def newpayload = /[aeiou]/.matcher(ctx.payload).replaceAll(''); payload.epochtime = ctx.execution_time.getMillis() ; return payload;",
"lang": "painless"
}
},

5

please provide the exception as well and not just your snippet or again the full output of the execute watch API.

--Alex

6

Hi Alex,

Thaks for looking into this. If I take out the statement def newpayload = /[aeiou]/.matcher(ctx.payload).replaceAll(''); from the script I am able to save the watcher.
Otherwise it gives the above mentioned error in the Wather Edit page in Kibana.

Looks like it is related to enabling the script.painless.regex.enabled as the statement I am using is having the regex. Just I am wondering by default the script.painless.regex.enabled is not set may be it is throwing this error.

7

can you try to store the watch in the console and see if an error gets returned that you can paste here?

And yes, you need to have that setting enabled in order to make it work, otherwise an exception will be thrown.

8

Let me know what you think. I don't want to add script.painless.regex.enabled: true in elasticsearch.yml and restart the master nodes. Wanted to know whether I can set this parameter dynamically.

9

this is not a dynamic parameter, for a very good reason, as it opens up a security issue, if someone can write complex long processing regular expressions.

Also, just checking for vowels is something you do not need a regex for, maybe you can work around that, i.e. by using String.indexOf is you just have such simple checks?

10

Yes Sure. I want to replace some special characters like : " etc from the context.payload as these are disturbing the JSON structure in webhook.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.