How to access a value under an array, it returns as MISSING VALUE

[wajika]

I want to get the data of the message, but it didn't succeed.

How to access a value under an array？

alert_text_args:
  - "@timestamp"
  - service.name
  - error.exception.message

error.exception.message format

"error": {
      "exception": [
        {
          "stacktrace": [
	      XXXXXX
	      ......
          ],
          "handled": false,
          "message": "XXXX",
          "type": "XXXX"
        }
  ]
}

[ferozsalam]

I haven't tried this myself, but the documentation here says:

When using alert_text_args, you can access nested fields and index into arrays. For example, if your match was {"data": {"ips": ["127.0.0.1", "12.34.56.78"]}}, then by using "data.ips[1]" in alert_text_args, it would replace value with "12.34.56.78". This can go arbitrarily deep into fields and will still work on keys that contain dots themselves.

[wajika]

Failed validating 'type' in schema['properties']['alert_text_args']:
    {'items': {'type': 'string'}, 'type': 'array'}

On instance['alert_text_args']:
    '{match[error][exception][message]}'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/python36/lib/python3.6/site-packages/elastalert/loaders.py", line 115, in load
    rule = self.load_configuration(rule_file, conf, args)
  File "/usr/local/python36/lib/python3.6/site-packages/elastalert/loaders.py", line 180, in load_configuration
    self.load_options(rule, conf, filename, args)
  File "/usr/local/python36/lib/python3.6/site-packages/elastalert/loaders.py", line 232, in load_options
    raise EAException("Invalid Rule file: %s\n%s" % (filename, e))
elastalert.util.EAException: Invalid Rule file: rules/1.yaml
'{match[error][exception][message]}' is not of type 'array'

Failed validating 'type' in schema['properties']['alert_text_args']:
    {'items': {'type': 'string'}, 'type': 'array'}

On instance['alert_text_args']:
    '{match[error][exception][message]}'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/python36/bin/elastalert", line 11, in <module>
    load_entry_point('elastalert==0.2.4', 'console_scripts', 'elastalert')()
  File "/usr/local/python36/lib/python3.6/site-packages/elastalert/elastalert.py", line 2049, in main
    client = ElastAlerter(args)
  File "/usr/local/python36/lib/python3.6/site-packages/elastalert/elastalert.py", line 140, in __init__
    self.rules = self.rules_loader.load(self.conf, self.args)
  File "/usr/local/python36/lib/python3.6/site-packages/elastalert/loaders.py", line 126, in load
    raise EAException('Error loading file %s: %s' % (rule_file, e))
elastalert.util.EAException: Error loading file rules/1.yaml: Invalid Rule file: rules/1.yaml
'{match[error][exception][message]}' is not of type 'array'

Failed validating 'type' in schema['properties']['alert_text_args']:
    {'items': {'type': 'string'}, 'type': 'array'}

[ferozsalam]

Hey @wajika could you try error.exception[0].message?

[wajika]

can get the data of "error.exception [0]", but can't get "error.exception[0].message".

[ferozsalam]

Hmm interesting!

I will try and look into this more later, it sounds like the sort of thing we might want to support if it's not working.

[wajika]

If you have solved it, please feedback, thank you.

[wajika]

json_data='{"_source":{"error":{"exception":[{"handled":false,"message":"该任务已完成，如有疑问，请联系管理员","type":"Abp.UI.UserFriendlyException"}]}}}'

data = json.loads(json_data)
print(data['_source']['error']['exception'][0]['message'])

I tested it in python and it succeeded.

[wajika]

@jertel hi brother, can you solve it?

[jertel]

Try error.exception[0]message
Note the lack of a . before the message.

[wajika]

Try error.exception[0]message
Note the lack of a . before the message.

Thank you for your answer, solved.