Is nested querying supported for per-document monitor?

Plugins Alerting
1

Versions: latest

Describe the issue: I was experimenting with per-document monitors and is filtering on nested fields supported in this type of monitor?

Index mapping snippet:

{
  "_data_stream_timestamp": {
    "enabled": true
  },
  "properties": {
    "@timestamp": {
      "type": "date"
    },
    "overall_status": {
      "fields": {
        "keyword": {
          "type": "keyword",
          "ignore_above": 256
        }
      },
      "type": "text"
    },
    "status_apps": {
      "type": "nested",
      "properties": {
        "app_name": {
          "type": "text"
        },
        "instance_count": {
          "type": "integer"
        }
      }
    }
  }
}

Can i create a per-document monitor which looks for overall_status == “SUCCESS” and instance_count is greater than 0?

I’ve only issue with the nested objects. Unfortunately, the logs are much complex and I’ve simplified it for this question.

Is nested querying supported for per-document monitors similar to query-level monitor

Thanks in advance.

2

@pablo Can you help here?

3

hey @abinabu ,

Nested fields can be used in monitors, you could create a monitor something like this

POST /_plugins/_alerting/monitors
{
  "name": "testNestedFields",
  "type": "monitor",
  "enabled": true,
  "schedule": {
    "period": {
      "interval": 5,
      "unit": "MINUTES"
    }
  },
  "inputs": [
    {
      "search": {
        "indices": [
          "application_status_logs"
        ],
        "query": {
          "size": 100,
          "query": {
            "nested": {
              "path": "status_apps",
              "query": {
                "bool": {
                  "must": [
                    {
                      "match": {
                        "overall_status.keyword": "SUCCESS"
                      }
                    },
                    {
                      "range": {
                        "status_apps.instance_count": {
                          "gt": 0
                        }
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  ],
  "triggers": [
    {
      "name": "Backend API Instance Count Low Trigger",
      "severity": "1",
      "condition": {
        "script": {
          "source": "true"
        }
      },
      "actions": [
        {
          "name": "Send notification",
          "destination_id": "your-destination-id",
          "message_template": {
            "source": "⚠️ Backend API instance count low.\nDoc: {{ctx._id}}\nCount: {{ctx._source.status_apps.instance_count}}\nTimestamp: {{ctx._source['@timestamp']}}"
          }
        }
      ]
    }
  ]
}

You might also find it useful to read about nested fields - Nested - OpenSearch Documentation You will learn how to query and then can use both to make your own custom monitors.

Leeroy.