Cannot Transform Correctly with Elasticsearch Watcher {{ctx.payload.hits.hits}}

Question

I have a watcher configuration as follows:

{
  "trigger": {
    "schedule": {
      "interval": "5s"
    }
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : [ "my_index" ],
        "types" : [ "my_type" ],
        "body" : {
          "query" : {
            "match_all" : {}
           }
        }
      }
    }
  },
  "transform" : {
      "script" : "return [ body: groovy.json.JsonOutput.toJson(ctx.payload.hits.hits)]"
  },
  "actions" : {
    "hbase_webhook" : {
        "webhook" : {
            "method" : "POST",
            "host" : "<some_ip>",
            "port" : <some_port>,
            "path": "/v0.1/_events",
            "body" : "data: {{ctx.payload.body}}"
        }
    }
  }
}

The data posted in the body is not a valid JSON: Something like:

{ 'data: ': { '{"_index":"my_index","_type":"my_type","_source":{"key":"val"}},"_id":"<some_id>","_score":1.0}': '' } }

I don't know how to parse this output as JSON.parse in Node.js won't correctly parse it anyway.

I am not saying that it does not work. When I return it as is with {{ctx.payload.body}} (without data: part, it still does not parse. — Hasan Can Saral, May 25 '16 at 15:59
_When I return it as is with {{ctx.payload.body}} (without data: part, it still does not parse._ what's the parsing error you get? — Andrei Stefan, May 25 '16 at 17:35
@AndreiStefan Sorry my bad. In fact, I am getting a strangely formed JSON, such as `{ '{"_index":"","_type":"","_source":{"":"", ...},"_id":"","_score":1.0}': '' }` where the data is the key and the value is `''`. If no document is matched, it is `{ '0': '' }`. Any thoughts? I think I am getting close though :) — Hasan Can Saral, May 28 '16 at 20:40

score 3 · Accepted Answer · answered May 30 '16 at 12:31

3

Never. Forget. Headers.

I was forgetting:

"headers" {
    "Content-type": "application/json"
}

So it was impossible to parse with any tool.

answered May 30 '16 at 12:31

Hasan Can Saral

2,950
5
43
78

score 1 · Answer 2 · answered May 04 '21 at 14:02

Ran into this while creating an alert for an endpoint where we just wanted to send off the actual records that matched specific criteria. See sample below:

"actions": {
    "my_webhook": {
      "webhook": {
        "scheme": "https",
        "host": "webhook.site",
        "port": 443,
        "method": "post",
        "path": "/webhooksiteguidwouldbehere",
        "params": {},
        "headers": {
          "Content-type": "application/json"
        },
        "body": "{{#toJson}}ctx.payload.hits.hits{{/toJson}}"
      }
    }
  }

Second Note: If the body size is set to 0 your hits will be returned as null. :)

Cannot Transform Correctly with Elasticsearch Watcher {{ctx.payload.hits.hits}}

2 Answers2