Hello, I am trying to create a watcher that scans a log index and once it finds a search term, writes the JSON payload to a new index with an Index action. I am seeing that the data that is reaching the Index this way is different in format than when we hit the elastic endpoint directly through Pos…

In the painless transform, use: ... [ 'app_message ': h._source.app_message, '@timestamp': ctx.execution_time ] ...

Watcher with Index Action - Not writing data properly

Luca_Belluccini (Luca Belluccini) May 15, 2020, 8:04pm 12

Glad it helped!

Topic		Replies	Views
Sending data to existing elasticsearch index through Watcher Elasticsearch elastic-stack-alerting	7	790	June 1, 2020
Using painless in watcher Elasticsearch elastic-stack-alerting	20	4038	October 26, 2018
Iterate over payload in Index action Elasticsearch elastic-stack-alerting	4	2120	January 14, 2020
Ctx.payload.hits.hits.0._source.field to watcher-history index Elasticsearch elastic-stack-alerting	15	7043	May 10, 2018
Transform single hit into multiple documents with Index action Elasticsearch elastic-stack-alerting	8	3208	September 20, 2018