Support multiple inputs for a Monitor

#1

As i know Monitor does not support multiple inputs, something similar to main stream Chain Input https://www.elastic.co/guide/en/elastic-stack-overview/6.5/input-chain.html ? Is there any way i can workaround for this? My need is i want to execute 2 queries, the first query result will be an input for the next one (Lookup for a list of ids in first query and use it as a filter in second one).

Thank you!

#2

Hi @vietpham thanks for the feedback. Today we support a single ES query in the monitor, and don’t have a way to do chaning We have opened an issue for supporting alert chaining. Please feel free to give it a :+1: and add any context for your use case. https://github.com/opendistro-for-elasticsearch/alerting/issues/43

1 Like
#3

Thanks @elifish for opening this issue.

#4

Hi Vietpham,

If you are trying to use the second query to just filter out the search results from the first query, you may want to check post-filter in below link as workaround.
https://www.elastic.co/guide/en/elasticsearch/reference/6.6/search-request-post-filter.html.

Example:-

   curl -X PUT "localhost:9200/shirts" -H 'Content-Type: application/json' -d'
{
    "mappings": {
            "properties": {
                "brand": { "type": "keyword"},
                "color": { "type": "keyword"},
                "model": { "type": "keyword"}
            }
    }
}
'

=====
DOCS
====

curl -X PUT "localhost:9200/shirts/_doc/1?refresh" -H 'Content-Type: application/json' -d'
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": 2
}
'
 
curl -X PUT "localhost:9200/shirts/_doc/2?refresh" -H 'Content-Type: application/json' -d'
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": 5
}
'
 
 
curl -X PUT "localhost:9200/shirts/_doc/3?refresh" -H 'Content-Type: application/json' -d'
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": 1
}
'
 
curl -X PUT "localhost:9200/shirts/_doc/4?refresh" -H 'Content-Type: application/json' -d'
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": -8
}
'
 
curl -X PUT "localhost:9200/shirts/_doc/5?refresh" -H 'Content-Type: application/json' -d'
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": 9
}
'

===========
Post filter on search results for price less than 6

curl -X GET "localhost:9200/shirts/_search" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "filter": {
        "term": { "brand": "gucci" } 
      }
    }
  },
"post_filter": {
    "range" : { "price" : { "lt" : 6 } }
  }
}
'

===========
Output

{"took":5,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":4,"relation":"eq"},"max_score":0.0,"hits":[{"_index":"shirts","_type":"_doc","_id":"1","_score":0.0,"_source":
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": 2
}
},{"_index":"shirts","_type":"_doc","_id":"2","_score":0.0,"_source":
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": 5
}
},{"_index":"shirts","_type":"_doc","_id":"3","_score":0.0,"_source":
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": 1
}
},{"_index":"shirts","_type":"_doc","_id":"4","_score":0.0,"_source":
{
    "brand": "gucci",
    "color": "red",
    "model": "slim",
    "price": -8
}
}]}}
#5

Thanks @vamshin for suggesting. But my context is still different and ‘post_filter’ may not cable to apply here. The second filter value is completely dynamic and be a result of the first query. It is pricing value 6 comparing to your example.

Viet