How to pass the payload as input to 'transform' process in ELK watcher? I have tried with following way but it pass them as string to groovy file.
"transform": {
"script": {
"file": "error_parser",
"lang": "groovy",
"params": {
"inputval": "{{ctx.payload.aggregations.errorcount.buckets}}"
}
}
}
When I wanted to pass a string or integer, I face no issues, but with objects. Is there a way to pass them to file? And in this case, where do the output value that we return from groovy script stored (The 'condition' process evaluates the output to boolean in similar case)?
Groovy content:
println inputval
return inputval[0].doc_count
I get following error when I execute the watcher
{{ctx.payload.aggregations.errorcount.buckets}}
[2016-03-22 17:23:08,637][ERROR][watcher.transform.script ] [Hannah Levy] failed to execute [script] transform for [my-watch_2-2016-03-22T21:23:08.617
Z]
ScriptException[failed to run file script [error_parser] using lang [groovy]]; nested: MissingPropertyException[No such property: doc_count for class:
java.lang.String];
at org.elasticsearch.script.groovy.GroovyScriptEngineService$GroovyScript.run(GroovyScriptEngineService.java:318)
at org.elasticsearch.watcher.transform.script.ExecutableScriptTransform.doExecute(ExecutableScriptTransform.java:73)
at org.elasticsearch.watcher.transform.script.ExecutableScriptTransform.execute(ExecutableScriptTransform.java:59)
at org.elasticsearch.watcher.transform.script.ExecutableScriptTransform.execute(ExecutableScriptTransform.java:40)
I'm pretty sure you cannot do this :
"inputval": "{{ctx.payload.aggregations.errorcount.buckets}}"
I would do this in your script instead
println ctx.payload.aggregations.errorcount.buckets
return ctx.payload.aggregations.errorcount.buckets[0].doc_count
and I'd remove the params for the script part