Issue Creating Monitor with Per Query Monitor and Extraction Query Editor

I am currently facing an issue while attempting to create a monitor using the Per Query Monitor along with the Extraction Query Editor in OpenSearch. The problem revolves around an unexpected behavior where the ctx variable, which should contain the results of my extraction query, appears to be empty despite having matching documents.

Extraction Query:

{
    "size": 2,
    "_source": {
        "includes": ["stream"]
    },
    "query": {
        "match_all": {}
    }
}

Results from Extraction Query:

{
    "_shards": {
        "total": 100,
        "failed": 0,
        "successful": 100,
        "skipped": 0
    },
    "hits": {
        "hits": [
            {
                "_index": "fluent-bit-2023.10.23",
                "_type": "_doc",
                "_source": {
                    "stream": "stderr"
                },
                "_id": "ekQeXIsB435SyzO_uELE",
                "_score": 1
            },
            {
                "_index": "fluent-bit-2023.10.23",
                "_type": "_doc",
                "_source": {
                    "stream": "stderr"
                },
                "_id": "e0QeXIsB435SyzO_uELF",
                "_score": 1
            }
        ],
        "total": {
            "value": 10000,
            "relation": "gte"
        },
        "max_score": 1
    },
    "took": 68,
    "timed_out": false
}

Despite having matching documents for the specified query, the ctx variable in the monitoring setup returns empty results. This behavior is unexpected and is preventing the successful setup of triggers and notification messages based on the extraction query.

Screenshots:

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.