I am trying to create a elasticsearch watcher which will get some aggregation in last 20 mins with the following conditions:
- type is equal to fax
- Plan is equal to plan_a
And the aggregations are: - automated – Where the keyword is “System”
- total – Count all
- rate – automated/total
And the condition is automation rate is less than 20%
I have the following code
{
"trigger": {
"schedule": {
"cron": "0 */5 11-23 ? * MON-FRI"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"servicecase"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"filter": {
"range": {
"@timestamp": {
"gte": "now-20m",
"lt": "now"
}
}
}
}
},
"aggs": {
"filtered_cases": {
"filter": {
"bool": {
"must": [
{
"term": {
"type.keyword": "FAX"
}
},
{
"term": {
"plan.keyword": "plan_a"
}
}
]
},
"aggs": {
"automated_count": {
"term": {
"outcome.completedBy.keyword": "System"
}
},
"total_count": {
"value_count": {
"field": "_index"
}
},
"automation_rate": {
"bucket_script": {
"buckets_path": {
"automated": "automated_count>automated_count_value",
"total": "total_count"
},
"script": "(params.automated / params.total) * 100"
}
}
}
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.aggregations.filtered_cases.automation_rate.value": {
"gte": 20
}
}
},
"actions": {
...
}
}
But I keep getting the following error
"
root_cause": [
{
"type": "parsing_exception",
"reason": "[bool] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",
"line": 1,
"col": 224
}
],
Could anyone help with this issue?
I am expecting the elasticsearch watcher should run with out any error