Hi Everyone,
I'm somewhat new to Kibana and this is my first watcher. It's pretty simple, it looks for a hit on the previous day and if it finds one, it sends an email. When I simulate it, by setting the gte to -2d (there were 4 hits two days ago, but none yesterday), it logs true and sends the email. However, it didn't do that when it ran live yesterday looking at the day before. Also the log text didn't print the number of hits. Here is the code (I removed my email address), and the simulated response:
{
"trigger": {
"schedule": {
"daily": {
"at": [
"5:00"
]
}
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"mybusiness_user_lock*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"ts_inserted_dt": {
"gte": "{{ctx.trigger.scheduled_time}}||-2d",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "if (ctx.payload.hits.total > params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 0
}
}
},
"actions": {
"my-logging-action": {
"logging": {
"level": "info",
"text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 0."
}
},
"send_email": {
"email": {
"profile": "standard",
"to": [
"michelle.hughes@....com"
],
"subject": "Daily MyBusiness Lock Error Notification!",
"body": {
"text": """
There is a new user lock error, please investigate.
(https://myurl)
"""
}
}
}
},
"transform": {
"script": {
"source": "HashMap result = new HashMap(); result.result = ctx.payload.hits.total; return result;",
"lang": "painless",
"params": {
"threshold": 0
}
}
}
}
Simulation Output:
{
"watch_id": "_inlined_",
"node": "flzqM9O9SyyNZnhBWPeaMA",
"state": "executed",
"user": "elastic",
"status": {
"state": {
"active": true,
"timestamp": "2022-02-01T20:53:24.130Z"
},
"last_checked": "2022-02-01T20:53:24.131Z",
"last_met_condition": "2022-02-01T20:53:24.131Z",
"actions": {
"my-logging-action": {
"ack": {
"timestamp": "2022-02-01T20:53:24.131Z",
"state": "ackable"
},
"last_execution": {
"timestamp": "2022-02-01T20:53:24.131Z",
"successful": true
},
"last_successful_execution": {
"timestamp": "2022-02-01T20:53:24.131Z",
"successful": true
}
},
"send_email": {
"ack": {
"timestamp": "2022-02-01T20:53:24.131Z",
"state": "ackable"
},
"last_execution": {
"timestamp": "2022-02-01T20:53:24.131Z",
"successful": true
},
"last_successful_execution": {
"timestamp": "2022-02-01T20:53:24.131Z",
"successful": true
}
}
},
"execution_state": "executed",
"version": -1
},
"trigger_event": {
"type": "manual",
"triggered_time": "2022-02-01T20:53:24.131Z",
"manual": {
"schedule": {
"scheduled_time": "2022-02-01T20:53:24.131Z"
}
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"mybusiness_user_lock*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"ts_inserted_dt": {
"gte": "{{ctx.trigger.scheduled_time}}||-2d",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "if (ctx.payload.hits.total > params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 0
}
}
},
"metadata": {
"name": "MyBusiness-User-Lock-Error",
"xpack": {
"type": "json"
}
},
"result": {
"execution_time": "2022-02-01T20:53:24.131Z",
"execution_duration": 1187,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 1,
"failed": 0,
"successful": 1,
"skipped": 0
},
"hits": {
"hits": [],
"total": 4,
"max_score": null
},
"took": 1,
"timed_out": false
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"mybusiness_user_lock*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"ts_inserted_dt": {
"gte": "2022-02-01T20:53:24.131088176Z||-2d",
"lte": "2022-02-01T20:53:24.131088176Z",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
}
}
}
}
},
"condition": {
"type": "script",
"status": "success",
"met": true
},
"transform": {
"type": "script",
"status": "success",
"payload": {
"result": 4
}
},
"actions": [
{
"id": "my-logging-action",
"type": "logging",
"status": "success",
"logging": {
"logged_text": "There are documents in your index. Threshold is 0."
}
},
{
"id": "send_email",
"type": "email",
"status": "success",
"email": {
"account": "gmail_account",
"message": {
"id": "send_email__inlined__441efc96-15e8-4108-b3f6-dc504e82604a-2022-02-01T20:53:24.131102179Z_11",
"sent_date": "2022-02-01T20:53:24.133728163Z",
"to": [
"michelle.hughes@....com"
],
"subject": "Daily MyBusiness Lock Error Notification!",
"body": {
"text": "\n There is a new user lock error, please investigate.\n (https://myurl)\n "
}
}
}
}
]
},
"messages": []
}