Payload transformation hack stopped working in 2.9

Plugins Alerting
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 2.9

Describe the issue:
As I am not the only one that needs data transformation, I came across a simple hack hack
to run painless code.
Long story short, up until version 2.9 it was possible to modify the ctx payload in the trigger script to add new data,e.g.

List al = ctx.results[0].aggregations.2.buckets.stream()
.filter(t -> (t.key == 'SECURITY_ERROR' && t.doc_count > 1000) ||
             (t.key == 'DATA_CANNOT_BE_INTERPRETED' && t.doc_count >1000) ||
             (t.key == 'ACCESS_DENIED' && t.doc_count > 2000) ||
             (t.key == 'UNEXPECTED_MESSAGE_RECEIVED' && t.doc_count > 1000) ||
             (t.key == 'INTERNAL_SYSTEM_ERROR' && t.doc_count > 1000))
.collect(Collectors.toList());

ctx.results[0].condition = al;
return al.size() > 0

Consequently, it was then possible to use this data in the moustache template, e.g.

{{#ctx.results.0.condition}}
{{key}} {{doc_count}} 
{{/ctx.results.0.condition}}

Unfortunately, this hack stopped working in 2.9; while it is still possible to modify the payload and correctly render the mail preview, the notification engine takes only into account the original result payload and it renders any reference to new data as blank.

My questions:

  • Is the new behavior in 2.9 desired or just a side effect of the new features ?
  • Are we going to have a proper transformation method in the near future ?
  • Is there a way to make my “hack” work ?

I have also filed an issue on Github, but I am not sure I can classify this change as a bug.

2

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.