Convert watches elasticsearch output to json with groovy - json

Question

I want to convert payload.hits.hits to json in elasticsearch watcher output. I found as a solution groovy transform script :
PUT _watcher/watch/error_alert
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"body": {
"query": {
"bool": {
"must": [
{
"query_string": {
"default_field": "message",
"query": "ERROR"
}
},
{
"range": {
"#timestamp": {
"gte": "now-1m",
"lte": "now"
}
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"transform" : {
"script" : "return [ body: groovy.json.JsonOutput.toJson(ctx.payload.hits.hits)]"
},
"actions": {
"some_webhook": {
"webhook": {
"method": "POST",
"host": "*.*.*.*",
"port": 4000,
"path": "/sms",
"headers": {
"Content-Type": "application/json"
},
"body": "message: {{ctx.payload.body}}"
}
}
}
}
This request returns this exception:
"type": "general_script_exception",
"reason": "failed to compile script [ScriptException[compile error]; nested: IllegalArgumentException[Variable [body] is not defined.];]"
I have tried many alternative solutions but it seems that it works for most of people except me!
I use:
Elasticsearch 5.3.0
Kibana 5.0.2
Can someone help me please !

Answer 1

Looks like a syntax issue in your json.
"return [ body: groovy.json.JsonOutput.toJson(ctx.payload.hits.hits)]"
Try
"return { 'body': JsonOutput.toJson(ctx.payload.hits.hits)}"