› › ›

Watcher script payload transform

A payload transform that executes a script on the current payload in the watch execution context and replaces it with a newly generated one. The following snippet shows how a simple script payload transform can be defined on the watch level:

The script payload transform is often useful when used in combination with the search payload transform, where the script can extract only the significant data from a search result, and by that, keep the payload minimal. This can be achieved with the chain payload transform.

{
  "transform" : {
    "script" : "return [ 'time' : ctx.trigger.scheduled_time ]" 
  }
}

A simple painless script that creates a new payload with a single time field holding the scheduled time.

The executed script may either return a valid model that is the equivalent of a Java™ Map or a JSON object (you will need to consult the documentation of the specific scripting language to find out what this construct is). Any other value that is returned will be assigned and accessible to/via the _value variable.

The script attribute may hold a string value in which case it will be treated as an inline script and the default elasticsearch script languages will be assumed (as described in Scripting). You can use the other scripting languages supported by Elasticsearch. For this, you need to set the script field to an object describing the script and its language. The following table lists the possible settings that can be configured:

Table 91. Script payload transform settings

Name	Required	Default	Description
`inline`	yes	-	When using an inline script, this field holds the script itself.
`id`	yes	-	When referring to a stored script, this field holds the id of the script.
`lang`	no	`painless`	The script language
`params`	no	-	Additional parameters/variables that are accessible by the script

When using the object notation of the script, one (and only one) of inline, or id fields must be defined.

In addition to the provided params, the scripts also have access to the standard watch execution context parameters.

© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/8.17/transform-script.html