[Website]: Template example does not work

[felipeavilis]

Type of issue

Other

What documentation page is affected

https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/input-http#_using_templates_2

What happened?

The value {{ctx.trigger.triggered_time}}||-5m of from in body does not work. {{ctx.trigger.triggered_time}} returns a string and cannot do the time math.

This happens because date math expressions only work in specific Elasticsearch contexts (like index names and date range queries), not in arbitrary mustache template positions.

To solve this i had to create a Transform Script.

{
  "transform": {
    "script": {
      "source": "ctx.payload.calculated_time = ZonedDateTime.parse(ctx.trigger.triggered_time).minusMinutes(5)",
      "lang": "painless"
    }
  }
}

Additional info

No response

[ketkee-aryamane]

Hi @felipeavilis! Thanks for reaching out and highlighting this. We’ve reviewed the issue and added it to our backlog for an upcoming sprint. We’ll keep this thread updated as we make progress. Your feedback helps us make the docs better for everyone. Thank you.

[samxbr]

I gave it a try with the following watcher definition and seems to work:

PUT /_watcher/watch/test_1
{
  "trigger" : { "schedule" : { "interval" : "10s" }},
  "input" : {
    "search" : {
      "request" : {
        "indices" : [ "my-index" ],
        "body" : {
          "query" : {
            "range": {
              "@timestamp": {
                "gte": "{{ctx.trigger.triggered_time}}||-5m"
              }
            }
          }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  }
}

@nastasha-solomon It looks to me the range query in the watcher documentation needs to be updated to use gte instead of from (and lte for to) according the range query documentation. From what I can tell the range query doesn't use from at least since 7.17 (the earliest version I checked), so it may just be that the watcher doc is really out-dated.

[nastasha-solomon]

Docs updated: https://www.elastic.co/docs/explore-analyze/alerts-cases/watcher/input-http#_using_templates_2