Hey @NAVYA_GOLI
Done something simiar to that , but I didnt use Anomaly Detection I used the Alerting.
Example:
{
"name": "Cluster Health Status",
"type": "monitor",
"monitor_type": "cluster_metrics_monitor",
"enabled": true,
"schedule": {
"period": {
"unit": "MINUTES",
"interval": 1
}
},
"inputs": [
{
"uri": {
"api_type": "CLUSTER_HEALTH",
"path": "_cluster/health",
"path_params": "",
"url": "http://localhost:9200/_cluster/health"
}
}
],
"triggers": [
{
"query_level_trigger": {
"id": "Fh94VYgBRnO25hGOnvYh",
"name": "Cluster Health Status",
"severity": "1",
"condition": {
"script": {
"source": "ctx.results[0].status == \"red\"",
"lang": "painless"
}
},
"actions": [
{
"id": "Fx94VYgBRnO25hGOnvYh",
"name": "Cluster Health Status",
"destination_id": "qR9mVYgBRnO25hGO-KYg",
"message_template": {
"source": "Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.\n - Trigger: {{ctx.trigger.name}}\n - Severity: {{ctx.trigger.severity}}\n - Period start: {{ctx.periodStart}}\n - Period end: {{ctx.periodEnd}}",
"lang": "mustache"
},
"throttle_enabled": false,
"subject_template": {
"source": "Cluster Status is red",
"lang": "mustache"
}
}
]
}
}
],
"ui_metadata": {
"schedule": {
"timezone": null,
"frequency": "interval",
"period": {
"unit": "MINUTES",
"interval": 1
},
"daily": 0,
"weekly": {
"tue": false,
"wed": false,
"thur": false,
"sat": false,
"fri": false,
"mon": false,
"sun": false
},
"monthly": {
"type": "day",
"day": 1
},
"cronExpression": "0 */1 * * *"
},
"monitor_type": "cluster_metrics_monitor",
"search": {
"searchType": "clusterMetrics",
"timeField": "",
"aggregations": [],
"cleanedGroupBy": [],
"bucketValue": 1,
"bucketUnitOfTime": "h",
"filters": []
}
}
}