extra/docker/elk/tools/EsAutoQuery/closedLoopAlarmDuration.json

   1 {
   2     "query" : {
   3         "bool": {
   4             "must": [
   5                 { "match": { "closedLoopEventStatus": "ABATED" } }
   6             ]
   7         }
   8     },
   9     "script_fields" : {
  10         "closedLoopAlarmDuration" : {
  11             "script" : {
  12                 "lang": "painless",
  13                 "source": "
  14 if (doc.get('closedLoopEventStatus.keyword').value == 'ABATED') {
  15    return doc.get('closedLoopAlarmEnd').value - doc.get('closedLoopAlarmStart').value;
  16 }
  17 return null
  18 "
  19             }
  20         }
  21         , "closedLoopAlarmStart" : {
  22             "script" : {
  23                 "lang": "painless",
  24                 "source": "doc['closedLoopAlarmStart']"
  25             }
  26         }
  27         , "closedLoopAlarmEnd" : {
  28             "script" : {
  29                 "lang": "painless",
  30                 "source": "doc['closedLoopAlarmEnd']"
  31             }
  32         }
  33     }
  34 }