Hello, I am trying to create a watcher that scans a log index and once it finds a search term, writes the JSON payload to a new index with an Index action.
I am seeing that the data that is reaching the Index this way is different in format than when we hit the elastic endpoint directly through Postman with a PUT request .
The data is properly parsed and inserted when done from postman as shown in snapshot below.
The JSON body is under the _source at parent level and hence the parsing is happening .
When same thing happens through Index action of a watcher , this is how it shows up in Kibana.
As you can see , the actual json payload is not at parent _source but inside hits->hits->_source.
How can I update my watcher script to write the json payload at the parent _source and not inside the hits->hits->_source
Any help is greatly appreciated. Thank you so much.
Here is my watcher script :
{
"trigger": {
"schedule": {
"hourly" : { "minute" : [ 0, 5, 10, 15 ,20, 25, 30, 35 ,40, 45, 50, 55 ] }
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"iks-dev*"
],
"types": [],
"body": {
"size": 1000,
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"match_phrase": {
"app_className": {
"query": "RequestAndResponseLogger"
}
}
},
{
"range": {
"@timestamp": {
"gte": "now-5m/m"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
},
"_source": [
"app_message"
],
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"example@gmail.com"
],
"subject": "Encountered {{ctx.payload.hits.total}} stats(Environment)!",
"body": {
"text": " Report \n\n {{#ctx.payload.hits.hits}}{{_source.app_recordLoc}}\n\n{{_source.app_message}}\n\n{{/ctx.payload.hits.hits}} "
}
}
},
"index_payload" : {
"index" : {
"index" : "tnr-doc-store-dev",
"doc_type" : "_doc"
}
}
},
"throttle_period_in_millis": 900000
}
