# Watcher weird error : cannot access method/field \[period\] from a null def reference

**URL:** <https://discuss.elastic.co/t/watcher-weird-error-cannot-access-method-field-period-from-a-null-def-reference/328765>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting, painless\
**Created:** [March 29, 2023, 3:29am UTC](https://discuss.elastic.co/t/watcher-weird-error-cannot-access-method-field-period-from-a-null-def-reference/328765 "2023-03-29T03:29:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul\_Chen1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_chen1/32/118677_2.png) [@Paul\_Chen1](https://discuss.elastic.co/u/Paul_Chen1)\
**Post date:** [March 29, 2023, 3:29am UTC](https://discuss.elastic.co/t/watcher-weird-error-cannot-access-method-field-period-from-a-null-def-reference/328765/1 "2023-03-29T03:29:25Z")

</div>

![截圖 2023-03-29 上午11.22.11](https://us1.discourse-cdn.com/elastic/original/3X/1/5/154f502fef98c23be3bd14fbc79156acb8a36d2c.png)

My watcher is working normally around 3 years until yesterday, suddenly can't fetch the right number of our doc.count.  
but weird thing is I think the code should be work, like I paste below

```auto
int past_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.past_4_hours_conversion.doc_count; 

int one_day_ago_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.one_day_ago_4_hours_conversion.doc_count; 

```

If one of above is work, they should be all work right?  
the screenshot shows the **one\_day\_ago\_4\_hours\_conversion\_count** is working  
but the **past\_4\_hours\_conversion\_count** show 0 instead.

![截圖 2023-03-29 上午11.26.06](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fe2fd619ec6c669e30a6428b89dc0cb43c445587.png)

Here is my watcher setting. you can ignore the actions type error because I delete some content.

```auto
{
  "trigger": {
    "schedule": {
      "interval": "1h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "filebeat-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "filter": [
                {
                  "bool": {
                    "minimum_should_match": 1,
                    "should": [
                      {
                        "query_string": {
                          "fields": [
                            "message"
                          ],
                          "query": "*purchase_notification*"
                        }
                      }
                    ]
                  }
                }
              ],
              "must": [
                {
                  "match_phrase": {
                    "event.module": {
                      "query": "haproxy"
                    }
                  }
                },
                {
                  "match_phrase": {
                    "fields.env": {
                      "query": "lt_production"
                    }
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-28h",
                      "lte": "now",
                      "format": "epoch_millis"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "period": {
              "date_range": {
                "ranges": [
                  {
                    "to": "now",
                    "from": "now-4h",
                    "key": "past_4_hours_conversion"
                  },
                  {
                    "to": "now-24h",
                    "from": "now-28h",
                    "key": "one_day_ago_4_hours_conversion"
                  }
                ],
                "field": "@timestamp",
                "keyed": true
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": """def threshold = 3; 
    ctx.payload.errorMessage = "";
    int past_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.past_4_hours_conversion.doc_count; 
    int one_day_ago_4_hours_conversion_count = ctx.payload.aggregations.period.buckets.one_day_ago_4_hours_conversion.doc_count; 
    def variance = (float)one_day_ago_4_hours_conversion_count/(float)past_4_hours_conversion_count;
    def error = (variance >= threshold);
    if (error) {
      ctx.payload.errorMessage += "The conversion count past 4 hours is smaller than yesterday same period
    please check the overall function. 
   past 4 hour count: " + past_4_hours_conversion_count + " 
   1 day ago same time period 4 hour count: " + one_day_ago_4_hours_conversion_count + " 
   Threshold: " + threshold;
    }
    
    return error;""",
      "lang": "painless"
    }
  },
  "actions": {
    "notify-slack": {
      "throttle_period_in_millis": 150000,
      "slack": {
        "message": {
          "to": [
            "test-hubot"
          ],
          "attachments": [
            {
              "color": "warning",
              "title": "LT Production\n \"{{ctx.payload.errorMessage}}\"",
              "text": "warning>"
            },
            {
              "color": "warning",
              "title": "Confluence Link",
              "text": "ignore it"
            }
          ]
        }
      }
    }
  }
}

```

And I query from devtools, seems ok when I paste the same aggs to it.  
anyidea why cause the error? or any information I need to provide further?

 ![截圖 2023-03-29 上午11.28.09](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5ffe230da6ed7a9e75ce9245eb9d9863fdb1f7f.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 29, 2023, 3:36am UTC](https://discuss.elastic.co/t/watcher-weird-error-cannot-access-method-field-period-from-a-null-def-reference/328765/2 "2023-03-29T03:36:33Z")

</div>

I do not have much experience with painless, but using it in some ingest pipelines process, If I'm not wrong this error normally happens when the referenced field does not exist.

Maybe this is the case?

I think you need to make it [null-safe](https://www.elastic.co/guide/en/elasticsearch/painless/master/painless-operators-reference.html#null-safe-operator).

Try changing the reference to this

```auto
ctx.payload?.aggregations?.period?.buckets?.past_4_hours_conversion?.doc_count

```

---

<div class="post-metadata">

**Author:** ![Paul\_Chen1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_chen1/32/118677_2.png) [@Paul\_Chen1](https://discuss.elastic.co/u/Paul_Chen1)\
**Post date:** [March 29, 2023, 3:47am UTC](https://discuss.elastic.co/t/watcher-weird-error-cannot-access-method-field-period-from-a-null-def-reference/328765/3 "2023-03-29T03:47:06Z")

</div>

still get same result and I run in simulate

"reason": "Cannot invoke "Object.getClass()" because "value" is null",

 ![截圖 2023-03-29 上午11.46.07](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96f4e8996abc25087716e2f0fbfdd2060654b90d.png)

 ![截圖 2023-03-29 上午11.46.23](https://us1.discourse-cdn.com/elastic/original/3X/9/2/921637627b3c264f3382b379d9efc8191393d838.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 29, 2023, 1:23pm UTC](https://discuss.elastic.co/t/watcher-weird-error-cannot-access-method-field-period-from-a-null-def-reference/328765/4 "2023-03-29T13:23:43Z")

</div>

Just one question, are you sure that the field name is correct?

In your aggregation you have `past_4_hours_conversion`, but in your code you are referencing to `past_4_hours`.

There is something wrong in the script in your screenshot and the code you shared.

The print screen have:

> past\_4\_hours\_conversion\_count = ctx.payload?.aggregations?.period?.buckets?. **past\_4\_hours**?.doc\_count

But this field does not exist in your aggregation, what you have is `past_4_hours_conversion`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2023, 1:24pm UTC](https://discuss.elastic.co/t/watcher-weird-error-cannot-access-method-field-period-from-a-null-def-reference/328765/5 "2023-04-26T13:24:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.