我正在尝试迭代聚合存储桶结果。聚合响应为：
"aggregations" : {
"agg1" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "India",
"doc_count" : 1,
"agg2" : {
"hits" : {
"total" : {
"value" : 2,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "my-idx",
"_type" : "_doc",
"_id" : "yCREtoIB_SgE9GPnmqdM",
"_score" : 1.0,
"_source" : {
"agent" : {
"name" : "john"
},
"country": "India",
"@timestamp" : "2022-08-19T13:22:03.818Z",
}
},
{
"_index" : "my-idx",
"_type" : "_doc",
"_id" : "zIxEtoIBwzTD3EsaokUn",
"_score" : 1.0,
"_source" : {
"agent" : {
"name" : "jack"
},
"country": "India",
"@timestamp" : "2022-08-19T13:22:04.771Z"
}
}
]
}
}
},
{
"key" : "USA",
"doc_count" : 1,
"agg2" : {
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "my-idx",
"_type" : "_doc",
"_id" : "SgE9GPnmqdM",
"_score" : 1.0,
"_source" : {
"agent" : {
"name" : "harry"
},
"country": "USA",
"@timestamp" : "2022-08-19T13:22:03.818Z",
}
}
}
]
}
}
}在上述回复中，由于形成的桶数为2（即印度和美国），因此应发送2封电子邮件。
而在第一封电子邮件（对应印度）中，正文应包含其点击率最高的聚合回复，如：
agent.name: "john"
@timestamp:
country: "India"
agent.name: "jack"
@timestamp:
country: "India"同样，对于第2封电子邮件（对应于美国），正文应包含
agent.name: "harry"
@timestamp:
country: "USA"我已经尝试了这个监视器配置。
{
"trigger": {
"schedule": {
"interval": "30m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"my-idx"
],
"rest_total_hits_as_int": true,
"body": {
}
}
}
},
"transform" : {
"script":
"""
return [
'test1': ctx.payload.aggregations.agg1.buckets.stream().map(a->a.agg2.hits)
.collect(Collectors.toList())
]
"""
},
"actions": {
"send_email": {
"foreach": "ctx.payload.aggregations.agg1.buckets",
"max_iterations": 100,
"email": {
"profile": "standard",
"to": [
"test@gmail.com"
],
"subject": "Foreach Test",
"body": {
"html": """
<html>
<body>
<table tyle="background-color: #f9f9ff;">
<tr>
<td class="col1">{{ctx.payload.test1}}</td>
</tr>
</table>
</body>
</html>
"""
}
}
}
}
}**问题是，在ctx.payload.test1中使用转换脚本时，我在一封电子邮件中获得了两个键（即India和USA）的最高点击聚合的完整点击响应。**虽然我为每个循环添加了内容，但它不起作用。
有人能帮我解决这个问题吗？
1条答案
按热度按时间ivqmmu1c1#
Tldr;
将步骤replace completely the current context转换为脚本中计算的新步骤。
...将有效负载转换为新有效负载的监视转换...
所以
ctx.payload.aggregations.agg1.buckets不应该再存在了。您需要使用
ctx.payload.test1来执行迭代。