# Alert monitor in make query in script more than (50) value to get data

**URL:** <https://forum.opensearch.org/t/alert-monitor-in-make-query-in-script-more-than-50-value-to-get-data/21470>\
**Category:** Alerting\
**Tags:** alerting\
**Created:** [September 16, 2024, 5:07am UTC](https://forum.opensearch.org/t/alert-monitor-in-make-query-in-script-more-than-50-value-to-get-data/21470 "2024-09-16T05:07:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![naman](https://avatars.discourse-cdn.com/v4/letter/n/5daacb/32.png) [@naman](https://forum.opensearch.org/u/naman)\
**Post date:** [September 16, 2024, 5:07am UTC](https://forum.opensearch.org/t/alert-monitor-in-make-query-in-script-more-than-50-value-to-get-data/21470/1 "2024-09-16T05:07:26Z")

</div>

hello  
i am using latest version of opensearch  
this is my alert monitor in Extraction query editor i want get only usage\_percentage value more than → 50 how to make query like this

```auto
{
  "size": 1,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "time": {
              "gte": "now-10m",
              "lt": "now"
            }
          }
        },
        {
          "terms": {
            "name.keyword": [
              "kube_node_cpu_usage",
              "kube_node_allocatable_cpu"
            ]
          }
        }
      ]
    }
  },
  "aggs": {
    "group_by_time": {
      "date_histogram": {
        "field": "time",
        "fixed_interval": "1s", 
        "min_doc_count": 1
      },
      "aggs": {
        "by_name": {
          "terms": {
            "field": "name.keyword"
          },
          "aggs": {
            "sum_values": {
              "sum": {
                "field": "value"
              }
            }
          }
        },
        "usage_percentage": {
          "bucket_script": {
            "buckets_path": {
              "cpu_usage": "by_name['kube_node_cpu_usage']>sum_values",
              "allocatable_cpu": "by_name['kube_node_allocatable_cpu']>sum_values"
            },
            "script": "params.allocatable_cpu > 0 ? (params.cpu_usage / params.allocatable_cpu) * 100 : 0 "
          }
        }
      }
    }
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [November 15, 2024, 5:07am UTC](https://forum.opensearch.org/t/alert-monitor-in-make-query-in-script-more-than-50-value-to-get-data/21470/2 "2024-11-15T05:07:49Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.