{"action":"created","issue":{"url":"https://api.github.com/repos/elasticfence/kaae/issues/40","repository_url":"https://api.github.com/repos/elasticfence/kaae","labels_url":"https://api.github.com/repos/elasticfence/kaae/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/elasticfence/kaae/issues/40/comments","events_url":"https://api.github.com/repos/elasticfence/kaae/issues/40/events","html_url":"https://github.com/elasticfence/kaae/issues/40","id":182491005,"number":40,"title":"MapperParsingException[Field name [...] cannot contain '.'","user":{"login":"maxout123","id":19927729,"avatar_url":"https://avatars.githubusercontent.com/u/19927729?v=3","gravatar_id":"","url":"https://api.github.com/users/maxout123","html_url":"https://github.com/maxout123","followers_url":"https://api.github.com/users/maxout123/followers","following_url":"https://api.github.com/users/maxout123/following{/other_user}","gists_url":"https://api.github.com/users/maxout123/gists{/gist_id}","starred_url":"https://api.github.com/users/maxout123/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maxout123/subscriptions","organizations_url":"https://api.github.com/users/maxout123/orgs","repos_url":"https://api.github.com/users/maxout123/repos","events_url":"https://api.github.com/users/maxout123/events{/privacy}","received_events_url":"https://api.github.com/users/maxout123/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elasticfence/kaae/labels/fixed","name":"fixed","color":"0e8a16"}],"state":"open","locked":false,"assignee":{"login":"lmangani","id":1423657,"avatar_url":"https://avatars.githubusercontent.com/u/1423657?v=3","gravatar_id":"","url":"https://api.github.com/users/lmangani","html_url":"https://github.com/lmangani","followers_url":"https://api.github.com/users/lmangani/followers","following_url":"https://api.github.com/users/lmangani/following{/other_user}","gists_url":"https://api.github.com/users/lmangani/gists{/gist_id}","starred_url":"https://api.github.com/users/lmangani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lmangani/subscriptions","organizations_url":"https://api.github.com/users/lmangani/orgs","repos_url":"https://api.github.com/users/lmangani/repos","events_url":"https://api.github.com/users/lmangani/events{/privacy}","received_events_url":"https://api.github.com/users/lmangani/received_events","type":"User","site_admin":false},"assignees":[{"login":"lmangani","id":1423657,"avatar_url":"https://avatars.githubusercontent.com/u/1423657?v=3","gravatar_id":"","url":"https://api.github.com/users/lmangani","html_url":"https://github.com/lmangani","followers_url":"https://api.github.com/users/lmangani/followers","following_url":"https://api.github.com/users/lmangani/following{/other_user}","gists_url":"https://api.github.com/users/lmangani/gists{/gist_id}","starred_url":"https://api.github.com/users/lmangani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lmangani/subscriptions","organizations_url":"https://api.github.com/users/lmangani/orgs","repos_url":"https://api.github.com/users/lmangani/repos","events_url":"https://api.github.com/users/lmangani/events{/privacy}","received_events_url":"https://api.github.com/users/lmangani/received_events","type":"User","site_admin":false}],"milestone":null,"comments":19,"created_at":"2016-10-12T10:32:03Z","updated_at":"2016-10-19T21:43:19Z","closed_at":null,"body":"I am trying to get notifications for \"topbeat\" metrics. As an example, when percent of disk space used is above threshold.\r\n\r\nIn short, on watcher save I get the error: `MapperParsingException[Field name [fs.used_p] cannot contain '.']`\r\n\r\n**Here's the details:**\r\n\r\n**The query working in Sense:**\r\n```\r\nGET _search\r\n{\r\n  \"query\": {\r\n    \"filtered\": {\r\n      \"query\": {\r\n        \"query_string\": {\r\n          \"query\": \"type: filesystem\",\r\n          \"analyze_wildcard\": true\r\n        }\r\n      },\r\n      \"filter\": {\r\n        \"bool\": {\r\n          \"must\": [\r\n            {\r\n              \"range\": {\r\n                \"@timestamp\": {\r\n                  \"gte\": \"now-10m\",\r\n                  \"lte\": \"now\"\r\n                }\r\n              }\r\n            },\r\n            {\r\n              \"range\": {\r\n                \"fs.used_p\": {\r\n                  \"gte\": 0.1\r\n                }\r\n              }\r\n            }\r\n          ],\r\n          \"must_not\": []\r\n        }\r\n      }\r\n    }\r\n  },\r\n  \"size\": 1,\r\n  \"aggs\": {\r\n    \"device_name\": {\r\n      \"terms\": {\r\n        \"field\": \"fs.mount_point\",\r\n        \"size\": 100\r\n      },\r\n      \"aggs\": {\r\n        \"used_p\": {\r\n          \"avg\": {\r\n            \"field\": \"fs.used_p\"\r\n          }\r\n        }\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n\r\n**And here is result from ES:**\r\n\r\n```\r\n{\r\n  \"took\": 84,\r\n  \"timed_out\": false,\r\n  \"_shards\": {\r\n    \"total\": 368,\r\n    \"successful\": 368,\r\n    \"failed\": 0\r\n  },\r\n  \"hits\": {\r\n    \"total\": 2,\r\n    \"max_score\": 3.1690538,\r\n    \"hits\": [\r\n      {\r\n        \"_index\": \"topbeat-2016.10.12\",\r\n        \"_type\": \"filesystem\",\r\n        \"_id\": \"AVe4XqQQLJiUKvRzXlL2\",\r\n        \"_score\": 3.1690538,\r\n        \"_source\": {\r\n          \"type\": \"filesystem\",\r\n          \"fs\": {\r\n            \"device_name\": \"/dev/vda1\",\r\n            \"total\": 31570522112,\r\n            \"used\": 4357283840,\r\n            \"used_p\": 0.14,\r\n            \"free\": 27213238272,\r\n            \"avail\": 25585963008,\r\n            \"files\": 1966080,\r\n            \"free_files\": 1820159,\r\n            \"mount_point\": \"/\"\r\n          },\r\n          \"count\": 1,\r\n          \"beat\": {\r\n            \"hostname\": \"h2\",\r\n            \"name\": \"h2\"\r\n          },\r\n          \"@timestamp\": \"2016-10-12T10:09:50.457Z\",\r\n          \"@version\": \"1\",\r\n          \"host\": \"h2\",\r\n          \"tags\": [\r\n            \"beats_input_raw_event\"\r\n          ]\r\n        }\r\n      }\r\n    ]\r\n  },\r\n  \"aggregations\": {\r\n    \"device_name\": {\r\n      \"doc_count_error_upper_bound\": 0,\r\n      \"sum_other_doc_count\": 0,\r\n      \"buckets\": [\r\n        {\r\n          \"key\": \"/\",\r\n          \"doc_count\": 2,\r\n          \"used_p\": {\r\n            \"value\": 0.14000000059604645\r\n          }\r\n        }\r\n      ]\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nNow I am trying to save this watcher in KAAE:\r\n\r\n```\r\n{\r\n  \"_index\": \"watcher\",\r\n  \"_type\": \"watch\",\r\n  \"_id\": \"test\",\r\n  \"_score\": 1,\r\n  \"_source\": {\r\n    \"trigger\": {\r\n      \"schedule\": {\r\n        \"later\": \"every 10 seconds\"\r\n      }\r\n    },\r\n    \"input\": {\r\n      \"search\": {\r\n        \"request\": {\r\n          \"index\": [\r\n            \"<topbeat-{now/d}>\"\r\n          ],\r\n          \"body\": {\r\n            \"query\": {\r\n              \"filtered\": {\r\n                \"query\": {\r\n                  \"query_string\": {\r\n                    \"query\": \"type: filesystem\",\r\n                    \"analyze_wildcard\": true\r\n                  }\r\n                },\r\n                \"filter\": {\r\n                  \"bool\": {\r\n                    \"must\": [\r\n                      {\r\n                        \"range\": {\r\n                          \"@timestamp\": {\r\n                            \"gte\": \"now-10m\",\r\n                            \"lte\": \"now\"\r\n                          }\r\n                        }\r\n                      },\r\n                      {\r\n                        \"range\": {\r\n                          \"fs.used_p\": {\r\n                            \"gte\": 0.1\r\n                          }\r\n                        }\r\n                      }\r\n                    ],\r\n                    \"must_not\": []\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    },\r\n    \"condition\": {\r\n      \"script\": {\r\n        \"script\": \"payload.hits.total > 0\"\r\n      }\r\n    },\r\n    \"transform\": {},\r\n    \"actions\": {\r\n      \"email_admin\": {\r\n        \"email\": {\r\n          \"to\": \"...@gmail.com\",\r\n          \"from\": \"kaae@localhost\",\r\n          \"subject\": \"KaaE Alarm\",\r\n          \"priority\": \"high\",\r\n          \"body\": \"Found Events\"\r\n        }\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nAnd getting the error:\r\n```\r\nOct 12 06:04:43  elasticsearch[3462]: [2016-10-12 06:04:43,179][DEBUG][action.admin.indices.mapping.put] [] failed to put mappings on indices [[watcher]], type [watch]\r\nOct 12 06:04:43  elasticsearch[3462]: MapperParsingException[Field name [fs.used_p] cannot contain '.']\r\n```\r\n\r\nBut this query works in Sense, and I am stuck with it. Could you please tell me what I am doing wrong and how to achieve my goal?\r\n"},"comment":{"url":"https://api.github.com/repos/elasticfence/kaae/issues/comments/254949801","html_url":"https://github.com/elasticfence/kaae/issues/40#issuecomment-254949801","issue_url":"https://api.github.com/repos/elasticfence/kaae/issues/40","id":254949801,"user":{"login":"guilhermef","id":101073,"avatar_url":"https://avatars.githubusercontent.com/u/101073?v=3","gravatar_id":"","url":"https://api.github.com/users/guilhermef","html_url":"https://github.com/guilhermef","followers_url":"https://api.github.com/users/guilhermef/followers","following_url":"https://api.github.com/users/guilhermef/following{/other_user}","gists_url":"https://api.github.com/users/guilhermef/gists{/gist_id}","starred_url":"https://api.github.com/users/guilhermef/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guilhermef/subscriptions","organizations_url":"https://api.github.com/users/guilhermef/orgs","repos_url":"https://api.github.com/users/guilhermef/repos","events_url":"https://api.github.com/users/guilhermef/events{/privacy}","received_events_url":"https://api.github.com/users/guilhermef/received_events","type":"User","site_admin":false},"created_at":"2016-10-19T21:43:18Z","updated_at":"2016-10-19T21:43:18Z","body":"@lmangani It worked with the properties field outside the payload."}}
{"actor":{"display_login":"guilhermef"}}