Wildcard in ctx.payload fileds

alerting

(Bogdan) #1

Hi there!

I am making a watch with 2 chain searches: [search1, search2]. They differ only in query body and return same fields so I'd like to put it in one watch.

The question is:
How to write multiple conditions, i.e if there is a hit for any search, fire an alarm?
wildcard seems not work, only if write a search name search1 condition works

"condition": {
    "compare": {
      "ctx.payload.*.hits.total": {
        "gt": "0"
      }
    }
  }

If use script with && to concatenate comparisons there is still a problem in Action section,
How to access payload fields {{#ctx.payload.hits.hits}}{{key}}{{/ctx.payload.hits.hits}} for specific (triggered) condition/search?
Or the only way to write 2 similar watches each with it own search?


(Alexander Reelsen) #2

Hey,

The compare condition cannot do this, you need to use scripting, i.e. like this (untested on top of my head)

"condition" :{
  "script" : "return ctx.payload.first.hits.total > 0 && ctx.payload.second.hits.total > 0"
}

Hope this helps!


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.