WARNING: Version 6.0 of the Elastic Stack has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Never Condition Array Compare Condition »

› › ›

Compare Condition

edit

Compare Condition

edit

Use the compare condition to perform a simple comparison against a value in the watch payload. You can use the compare condition without enabling dynamic scripting.

Supported Comparison Operators

Name	Description
`eq`	Returns `true` when the resolved value equals the given one (applies to numeric, string, list, object and values)
`not_eq`	Returns `true` when the resolved value does not equal the given one (applies to numeric, string, list, object and null values)
`gt`	Returns `true` when the resolved value is greater than the given one (applies to numeric and string values)
`gte`	Returns `true` when the resolved value is greater/equal than/to the given one (applies to numeric and string values)
`lt`	Returns `true` when the resolved value is less than the given one (applies to numeric and string values)
`lte`	Returns `true` when the resolved value is less/equal than/to the given one (applies to numeric and string values)

Using a Compare Condition

edit

To use the compare condition, you specify the value in the execution context that you want to evaluate, a comparison operator, and the value you want to compare against. For example, the following compare condition returns true if the number of the total hits in the search result is greater than or equal to 5:

{
  "condition" : {
    "compare" : {
      "ctx.payload.hits.total" : { 
        "gte" : 5 
      }
  }
}

	Use dot notation to reference a value in the execution context.
	Specify a comparison operator and the value you want to compare against.

When comparing dates and times, you can use date math expressions of the form <{expression}>. For example, the following expression returns true if the watch was executed within the last five minutes:

{
  "condition" : {
    "compare" : {
      "ctx.execution_time" : {
        "gte" : "<{now-5m}>"
      }
  }
}

You can also compare two values in the execution context by specifying the compared value as a path of the form of {{path}}. For example, the following condition compares the ctx.payload.aggregations.status.buckets.error.doc_count to the ctx.payload.aggregations.handled.buckets.true.doc_count:

{
  "condition" : {
    "compare" : {
      "ctx.payload.aggregations.status.buckets.error.doc_count" : {
        "not_eq" : "{{ctx.payload.aggregations.handled.buckets.true.doc_count}}"
      }
  }
}

Accessing Values in the Execution Context

edit

You use "dot-notation" to access values in the execution context. Values loaded into the execution context by the input are prefixed by ctx.payload.

You can reference entries in arrays using their zero-based array indices. For example, to access the third element of the ctx.payload.hits.hits array, use ctx.payload.hits.hits.2.

Name	Description
`ctx.watch_id`	The id of the watch that is currently executing.
`ctx.execution_time`	The time execution of this watch started.
`ctx.trigger.triggered_time`	The time this watch was triggered.
`ctx.trigger.scheduled_time`	The time this watch was supposed to be triggered.
`ctx.metadata.*`	Any metadata associated with the watch.
`ctx.payload.*`	The payload data loaded by the watch’s input.

« Never Condition Array Compare Condition »