Repository: sentinl/sentinl

Issue #40: MapperParsingException[Field name [...] cannot contain '.'
Created: 2016-10-12T10:32:03Z
I am trying to get notifications for "topbeat" metrics. As an example, when percent of disk space used is above threshold.
In short, on watcher save I get the error: MapperParsingException[Field name [fs.used_p] cannot contain '.']
Here's the details:
The query working in Sense:
GET _search
{
  "query": {
    "filtered": {
      "query": {
        "query_string": {
          "query": "type: filesystem",
          "analyze_wildcard": true
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "@timestamp": {
                  "gte": "now-10m",
                  "lte": "now"
                }
              }
            },
            {
              "range": {
                "fs.used_p": {
                  "gte": 0.1
                }
              }
            }
          ],
          "must_not": []
        }
      }
    }
  },
  "size": 1,
  "aggs": {
    "device_name": {
      "terms": {
        "field": "fs.mount_point",
        "size": 100
      },
      "aggs": {
        "used_p": {
          "avg": {
            "field": "fs.used_p"
          }
        }
      }
    }
  }
}

And here is result from ES:
{
  "took": 84,
  "timed_out": false,
  "_shards": {
    "total": 368,
    "successful": 368,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 3.1690538,
    "hits": [
      {
        "_index": "topbeat-2016.10.12",
        "_type": "filesystem",
        "_id": "AVe4XqQQLJiUKvRzXlL2",
        "_score": 3.1690538,
        "_source": {
          "type": "filesystem",
          "fs": {
            "device_name": "/dev/vda1",
            "total": 31570522112,
            "used": 4357283840,
            "used_p": 0.14,
            "free": 27213238272,
            "avail": 25585963008,
            "files": 1966080,
            "free_files": 1820159,
            "mount_point": "/"
          },
          "count": 1,
          "beat": {
            "hostname": "h2",
            "name": "h2"
          },
          "@timestamp": "2016-10-12T10:09:50.457Z",
          "@version": "1",
          "host": "h2",
          "tags": [
            "beats_input_raw_event"
          ]
        }
      }
    ]
  },
  "aggregations": {
    "device_name": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "/",
          "doc_count": 2,
          "used_p": {
            "value": 0.14000000059604645
          }
        }
      ]
    }
  }
}

Now I am trying to save this watcher in KAAE:
{
  "_index": "watcher",
  "_type": "watch",
  "_id": "test",
  "_score": 1,
  "_source": {
    "trigger": {
      "schedule": {
        "later": "every 10 seconds"
      }
    },
    "input": {
      "search": {
        "request": {
          "index": [
            "<topbeat-{now/d}>"
          ],
          "body": {
            "query": {
              "filtered": {
                "query": {
                  "query_string": {
                    "query": "type: filesystem",
                    "analyze_wildcard": true
                  }
                },
                "filter": {
                  "bool": {
                    "must": [
                      {
                        "range": {
                          "@timestamp": {
                            "gte": "now-10m",
                            "lte": "now"
                          }
                        }
                      },
                      {
                        "range": {
                          "fs.used_p": {
                            "gte": 0.1
                          }
                        }
                      }
                    ],
                    "must_not": []
                  }
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "script": {
        "script": "payload.hits.total > 0"
      }
    },
    "transform": {},
    "actions": {
      "email_admin": {
        "email": {
          "to": "...@gmail.com",
          "from": "kaae@localhost",
          "subject": "KaaE Alarm",
          "priority": "high",
          "body": "Found Events"
        }
      }
    }
  }
}

And getting the error:
Oct 12 06:04:43  elasticsearch[3462]: [2016-10-12 06:04:43,179][DEBUG][action.admin.indices.mapping.put] [] failed to put mappings on indices [[watcher]], type [watch]
Oct 12 06:04:43  elasticsearch[3462]: MapperParsingException[Field name [fs.used_p] cannot contain '.']

But this query works in Sense, and I am stuck with it. Could you please tell me what I am doing wrong and how to achieve my goal?

Duplicate issue #50: Kaae error on scheduler.js taking kibana down
Created: 2016-10-19T16:36:49Z
I've installed the latest snapshot on Kibana4, and created a new watcher:
{
  "_index": "watcher",
  "_type": "watch",
  "_id": "MRTS - response time",
  "_new": "true",
  "_source": {
    "trigger": {
      "schedule": {
        "later": "every 1 minute"
      }
    },
    "input": {
      "search": {
        "request": {
          "index": "mrts-stash-*",
          "body": {
            "query": {
              "filtered": {
                "query": {
                  "query_string": {
                    "query": "message:\"Request Done\"",
                    "analyze_wildcard": true
                  }
                },
                "filter": {
                  "range": {
                    "@timestamp": {
                      "from": "now-1h"
                    }
                  }
                }
              }
            },
            "aggs": {
              "response_time": {
                "percentiles": {
                  "field": "time_used",
                  "percents": [
                    95
                  ]
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "script": {
        "script": "payload.aggregations.response_time.values['95.0'] > 4"
      }
    },
    "transform": {},
    "actions": {
      "email_admin": {
        "throttle_period": "1m",
        "email": {
          "to": "example@example.com",
          "from": "kaae@localhost",
          "subject": "KAAE ALARM {{ payload._id }}",
          "priority": "high",
          "body": "Series Alarm {{ payload._id}}: {{ payload.hits.total }}"
        }
      }
    }
  }
}


Right after the first run, I get this error:
/opt/kibana/installedPlugins/kaae/server/lib/scheduler.js:87
          server.log(['status', 'info', 'KaaE'], 'Executing watch: ' + task._id + ' Next Round at ' + _later2['default'].schedule(interval).next(2).split(',')[1]);
                                                                                                                                                    ^

TypeError: _later2.default.schedule(...).next(...).split is not a function
    at watching (/opt/kibana/installedPlugins/kaae/server/lib/scheduler.js:70:132)
    at /opt/kibana/installedPlugins/kaae/server/lib/scheduler.js:64:69
    at [object Object].scheduleTimeout [as _onTimeout] (/opt/kibana/installedPlugins/kaae/node_modules/later/later.js:846:9)
    at Timer.listOnTimeout (timers.js:92:15)

Closing comment (2016-10-19T17:11:43Z): @lmangani Now It's working, but I still get an error when it runs:
Trace: { [Error: [mapper_parsing_exception] Field name [95.0] cannot contain '.']
  status: 400,
  message: '[mapper_parsing_exception] Field name [95.0] cannot contain \'.\'',
  path: '/watcher_alarms-2016.10.19/email_admin',
  query: { op_type: 'create' },
  body:
   { error:
      { root_cause: [Object],
        type: 'mapper_parsing_exception',
        reason: 'Field name [95.0] cannot contain \'.\'' },
     status: 400 },
  statusCode: 400,
  response: '{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"Field name [95.0] cannot contain \'.\'"}],"type":"mapper_parsing_exception","reason":"Field name [95.0] cannot contain \'.\'"},"status":400}',
  toString: [Function],
  toJSON: [Function] } undefined
    at /opt/kibana/installedPlugins/kaae/server/lib/actions.js:77:22
    at tryCatcher (/opt/kibana/node_modules/bluebird/js/main/util.js:26:23)
    at Promise._settlePromiseFromHandler (/opt/kibana/node_modules/bluebird/js/main/promise.js:503:31)
    at Promise._settlePromiseAt (/opt/kibana/node_modules/bluebird/js/main/promise.js:577:18)
    at Promise._settlePromises (/opt/kibana/node_modules/bluebird/js/main/promise.js:693:14)
    at Async._drainQueue (/opt/kibana/node_modules/bluebird/js/main/async.js:123:16)
    at Async._drainQueues (/opt/kibana/node_modules/bluebird/js/main/async.js:133:10)
    at Immediate.Async.drainQueues [as _onImmediate] (/opt/kibana/node_modules/bluebird/js/main/async.js:15:14)
    at processImmediate [as _immediateCallback] (timers.js:383:17)

But it looks related to: #40