Cannot divide multiple context values in Elasticsearch watcher

620 views Asked by At

I have created a watch in Elasticsearch to alert me if the ratio of http errors is greater than 15% of total requests over 60 minutes. I am using chain inputs to generate the dividend and divisor values for my ratio calculation.

In my condition I am using scripting to do the division and check if it is greater than my ratio.

However, whenever I use 2 ctx parameters to do the division, it always equals to zero.

If I play with it and only use one of ctx param, then it works fine.

It seems that we cannot use 2 ctx params in a condition.

Does anyone know how to get around this?

Below is my watch.

Thanks.

{
  "trigger" : {
    "schedule" : {
      "interval" : "5m"
    }
  },
  "input" : {
    "chain":{
      "inputs": [
      {
        "first": {
          "search" : {
            "request" : {
              "indices" : [ "logstash-*" ],
              "body" : {
                "query" : { 
                  "bool":{
                    "must": [
                      {
                      "match" : {"d.uri": "xxxxxxxx"}
                      },
                      { 
                      "match" : {"topic": "xxxxxxxx"}
                      }
                    ],
                    "filter": {
                      "range": {
                        "@timestamp": {
                          "gte": "now-60m"
                        }
                      }
                    }
                  }
                }
              }
            },
            "extract": ["hits.total"]
          }
        }
      },
      {
        "second": {
          "search" : {
            "request" : {
              "body" : {
                "query" : { 
                  "bool":{
                    "must": [
                      {
                      "match" : {"d.uri": "xxxxxxxx"}
                      },
                      { 
                      "match" : {"topic": "xxxxxxxx"}
                      },
                      { 
                      "match" : {"d.status": "401"}
                      }
                    ],
                    "filter": {
                      "range": {
                        "@timestamp": {
                          "gte": "now-60m"
                        }
                      }
                    }
                  }
                }
              }
            },
            "extract": ["hits.total"]
          }
        }
      }
      ]
    }
  },
  "condition" : {
    "script" : {
      "source" : "return (ctx.payload.second.hits.total / ctx.payload.first.hits.total) == 0"
    }
  }
}
1

There are 1 answers

0
Jean-Philippe On BEST ANSWER

The issue comes in fact from the fact that I was doing an integer division to get to a ratio in the form of 0.xx. I reversed the operation and it is working fine.