Watcher with foreach and aggregation

Elastic Stack Elasticsearch
1

Hi,
I have a watcher with an aggregation query.
The result of the aggregation is e.g:
"min_docs" : {
"value" : 17.0,
"keys" : [ "CID1","CID2" ]
}

I have defined the watcher condition and action defined as:
"condition": {
"compare": {
"ctx.payload.aggregations.min_docs.value": {
"lt": 100
}
}
},
"actions": {
"my-logging-action": {
"foreach": "ctx.payload.aggregations.min_docs.keys",
"max_iterations": 100,
"logging": {
"level": "info",
"text": "There are nodes with 100 documents in the last 15 minutes."
}
}
}

I want to have the key CID1 in the text for the first iteration and CID2 for the second iteration.

What is the correct way?

Regards Hans

2

Hey,

try this

POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
      }
    },
    "input": {
      "simple": {
        "foo": ["1", "2", "3"]
      }
    },
    "actions": {
      "logme": {
        "foreach" : "ctx.payload.foo",
        "logging": {
          "text": "Test {{ctx.payload._value}}"
        }
      }
    }
  }
}

As you can see, the values of the array (if they are single valued) are available in ctx.payload._value, otherwise ctx.payload is a map or an array.

Hope that helps.

P.S. It'd be great, if you could format your snippets, as it makes them much easier to read. This forums supports markdown, so snippets are almost easy as cake :slight_smile:

3

Thanks!
Sorry for the formatting.
Is a no-brainer.

4

Hi,

Can I access ctx.payload.aggregations.min_docs.value form the condition also in the text?

"condition": {
"compare": {
  "ctx.payload.aggregations.min_docs.value": {
    "lt": 100
  }
}
  },
 "actions": {
"my-logging-action": {
  "foreach": "ctx.payload.aggregations.min_docs.keys",
  "max_iterations": 100,
  "logging": {
    "level": "info",
    "text": "There are hosts with 0  documents in the last 15 minutes. {{#ctx.payload}}{{ctx.payload._value}}{{/ctx.payload}}"
  }
 }

}

5

hey,

there is no support for this out of the box to access the original payload. What you could to in a workaround, is to have a script transform, that puts the .value field into each element of the .keys field and thus it is accessible in the mustache payload.

--Alex

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.