mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-06-28 09:28:55 -04:00
255c9a7f95
**Problem:** For historical reasons, source files for the Elasticsearch Guide's security, watcher, and Logstash API docs are housed in the `x-pack/docs` directory. This can confuse new contributors who expect Elasticsearch Guide docs to be located in `docs/reference`. **Solution:** - Move the security, watcher, and Logstash API doc source files to the `docs/reference` directory - Update doc snippet tests to use security Rel: https://github.com/elastic/platform-docs-team/issues/208
54 lines
1.9 KiB
Text
54 lines
1.9 KiB
Text
[role="xpack"]
|
|
[[transform-chain]]
|
|
=== {watcher} chain {watcher-transform}
|
|
++++
|
|
<titleabbrev>Chain {watcher-transform}</titleabbrev>
|
|
++++
|
|
|
|
A <<transform,{watcher-transform}>> that executes an ordered list of configured
|
|
{watcher-transforms} in a chain, where the output of one transform serves as the
|
|
input of the next transform in the chain. The payload that is accepted by this
|
|
transform serves as the input of the first transform in the chain and the output
|
|
of the last transform in the chain is the output of the `chain` transform as a
|
|
whole.
|
|
|
|
You can use chain {watcher-transforms} to build more complex transforms out of
|
|
the other available transforms. For example, you can combine a
|
|
<<transform-search,`search`>> {watcher-transform} and a
|
|
<<transform-script,`script`>> {watcher-transform}, as shown in the following snippet:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
"transform" : {
|
|
"chain" : [ <1>
|
|
{
|
|
"search" : { <2>
|
|
"request": {
|
|
"indices" : [ "logstash-*" ],
|
|
"body" : {
|
|
"size" : 0,
|
|
"query" : {
|
|
"match" : { "priority" : "error" }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"script" : "return [ 'error_count' : ctx.payload.hits.total ]" <3>
|
|
}
|
|
]
|
|
}
|
|
--------------------------------------------------
|
|
// NOTCONSOLE
|
|
<1> The `chain` {watcher-transform} definition
|
|
<2> The first transform in the chain (in this case, a `search` {watcher-transform})
|
|
<3> The second and final transform in the chain (in this case, a `script`
|
|
{watcher-transform})
|
|
|
|
This example executes a `count` search on the cluster to look for `error` events.
|
|
The search results are then passed to the second `script` {watcher-transform}.
|
|
The `script` {watcher-transform} extracts the total hit count and assigns it to
|
|
the `error_count` field in a newly-generated payload. This new payload is the
|
|
output of the `chain` {watcher-transform} and replaces the payload in the watch
|
|
execution context.
|