My watcher is working normally around 3 years until yesterday, suddenly can't fetch the right number of our doc.count.
but weird thing is I think the code should be work, like I paste below
int past_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.past_4_hours_conversion.doc_count;
int one_day_ago_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.one_day_ago_4_hours_conversion.doc_count;
If one of above is work, they should be all work right?
the screenshot shows the one_day_ago_4_hours_conversion_count is working
but the past_4_hours_conversion_count show 0 instead.
Here is my watcher setting. you can ignore the actions type error because I delete some content.
{
"trigger": {
"schedule": {
"interval": "1h"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"filebeat-*"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"filter": [
{
"bool": {
"minimum_should_match": 1,
"should": [
{
"query_string": {
"fields": [
"message"
],
"query": "*purchase_notification*"
}
}
]
}
}
],
"must": [
{
"match_phrase": {
"event.module": {
"query": "haproxy"
}
}
},
{
"match_phrase": {
"fields.env": {
"query": "lt_production"
}
}
},
{
"range": {
"@timestamp": {
"gte": "now-28h",
"lte": "now",
"format": "epoch_millis"
}
}
}
]
}
},
"aggs": {
"period": {
"date_range": {
"ranges": [
{
"to": "now",
"from": "now-4h",
"key": "past_4_hours_conversion"
},
{
"to": "now-24h",
"from": "now-28h",
"key": "one_day_ago_4_hours_conversion"
}
],
"field": "@timestamp",
"keyed": true
}
}
}
}
}
}
},
"condition": {
"script": {
"source": """def threshold = 3;
ctx.payload.errorMessage = "";
int past_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.past_4_hours_conversion.doc_count;
int one_day_ago_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.one_day_ago_4_hours_conversion.doc_count;
def variance = (float)one_day_ago_4_hours_conversion_count/(float)past_4_hours_conversion_count;
def error = (variance >= threshold);
if (error) {
ctx.payload.errorMessage += "The conversion count past 4 hours is smaller than yesterday same period
please check the overall function.
past 4 hour count: " + past_4_hours_conversion_count + "
1 day ago same time period 4 hour count: " + one_day_ago_4_hours_conversion_count + "
Threshold: " + threshold;
}
return error;""",
"lang": "painless"
}
},
"actions": {
"notify-slack": {
"throttle_period_in_millis": 150000,
"slack": {
"message": {
"to": [
"test-hubot"
],
"attachments": [
{
"color": "warning",
"title": "LT Production\n \"{{ctx.payload.errorMessage}}\"",
"text": "warning>"
},
{
"color": "warning",
"title": "Confluence Link",
"text": "ignore it"
}
]
}
}
}
}
}
And I query from devtools, seems ok when I paste the same aggs to it.
anyidea why cause the error? or any information I need to provide further?
