为 Elasticsearch Watcher 创建 Slack 操作时访问名称中带有点的 _source 字段时出现问题

Question

我正在尝试创建一个带有动态附件的 Slack 操作。我的 _source 看起来像这样：

{
    "user.url": "https://api.github.com/users/...",
    "user.gists_url": "https://api.github.com/users/.../gists{/gist_id}",
    "user.repos_url": "https://api.github.com/users/.../repos",
    "date": "2018-04-27T14:34:10Z",
    "user.followers_url": "https://api.github.com/users/.../followers",
    "user.following_url": "https://api.github.com/users/.../following{/other_user}",
    "user.id": 123456,
    "user.avatar_url": "https://avatars0.githubusercontent.com/u/123456?v=4",
    "user.events_url": "https://api.github.com/users/.../events{/privacy}",
    "user.site_admin": false,
    "user.html_url": "https://github.com/...",
    "user.starred_url": "https://api.github.com/users/.../starred{/owner}{/repo}",
    "user.received_events_url": "https://api.github.com/users/.../received_events",
    "metric": "stars",
    "user.login": "...",
    "user.type": "User",
    "user.subscriptions_url": "https://api.github.com/users/.../subscriptions",
    "user.organizations_url": "https://api.github.com/users/.../orgs",
    "user.gravatar_id": ""
}

这是我的 Slack 操作

"actions": {
    "notify-slack": {
        "throttle_period_in_millis": 240000,
        "slack": {
            "account": "monitoring",
            "message": {
                "from": "Elasticsearch Watcher",
                "to": [
                    "#watcher"
                ],
            "text": "We have {{ctx.payload.new.hits.total}} new stars! And {{ctx.payload.old.hits.total}} in total.",
            "dynamic_attachments" : {
                "list_path" : "ctx.payload.new.hits.hits",
                "attachment_template" : {
                    "title" : "{{_source.[\"user.login\"]}}", 
                    "text" : "Users Count: {{count}}",
                    "color" : "{{color}}"
                }
            }
        }
    }
}

我似乎不知道如何访问我的 _source 字段，因为它们中有点。我试过：

"{{_source.[\"user.login\"]}}"
"{{_source.user.login}}"
"{{_source.[user.login]}}"
"{{_source.['user.login']}}"

Answer 1

The answer to my question is that you can't access _source keys with dots in them directly using mustache, you must first transform your data.

更新：

我能够通过使用转换来构建新对象来实现这一点。 Mustache 可能无法访问名称中带有点的字段，但 painless 可以！我将此转换添加到我的松弛对象中：

"transform" : {
    "script" : {
        "source" : "['items': ctx.payload.new.hits.hits.collect(user -> ['userName': user._source['user.login']])]",
        "lang" : "painless"
    }
}

现在在松弛动作动态附件中，我可以访问 items 数组：

"dynamic_attachments" : {
    "list_path" : "ctx.payload.items",
    "attachment_template" : {
        "title" : "{{userName}}", 
        "text" : "{{_source}}"
    }
}

旧答案：

所以根据 this 观察者使用小胡子。

并且根据 this 小胡子无法访问名称中带有点的字段。

为 Elasticsearch Watcher 创建 Slack 操作时访问名称中带有点的 _source 字段时出现问题

Problems accessing _source fields with a dot in the name when creating Slack action for Elasticsearch Watcher

elasticsearch

elasticsearch-watcher