Hello OpenSearch Community,
Context:
I am working on a project involving IoT data, where data from various devices is sent to AWS IoT Core and then indexed into an OpenSearch Provisioned Instance (version 2.7, latest available on AWS).
I have successfully set up the infrastructure, connected my devices and I’m indexing data without issues. Data can be visualized on dashboards, etc.
I also created a Per query monitor that checks the battery voltage of these devices and triggers an alert when the voltage goes above 4 volts (It’s always above 4 volts, I’m using that value just for testing).
Issue:
I am looking for a way to associate each alert with the specific device that generated it, so that I can take appropriate action. I’m using a CURL to the API to get the active alerts, however, the response does not include this information (device_data.id).
Configuration:
Curl to get last indexed data (for reference)
curl -XGET \
-u 'my-user:My-password' \
-G \
-d 'size=1' \
-d 'sort=timestamp:desc' \
'https://os.fakedomain.com/my-data-index/_search'
Response of that curl
{
"_shards": {
"failed": 0,
"skipped": 0,
"successful": 5,
"total": 5
},
"hits": {
"hits": [
{
"_id": "65xxxxxxxxxxxxxxxxxxxxxxxx",
"_index": "my-data-index",
"_score": null,
"_source": {
"client_data": {
"id": "15yyyyyyyyyyyyyyyyyyyyyyy",
"name": "Some Name"
},
"device_data": {
"battery": {
"external_voltage": 11.891475,
"voltage": 4.194689869880676
},
"id": "0x324zzzzzzzzzzzzzzz",
"name": "Water Pump 2"
},
"location": "-66.66666,-66.66666",
"sensor_data": {
"Current (A)": 0.1,
"Voltage (V)": 225.1
},
"timestamp": 1693946818753
},
"sort": [
1693946818753
]
}
],
"max_score": null,
"total": {
"relation": "gte",
"value": 10000
}
},
"timed_out": false,
"took": 1317
}
Alert Configuration
{
"name": "Test Monitor - Overvoltage (Battery)",
"type": "monitor",
"monitor_type": "query_level_monitor",
"enabled": false,
"schedule": {
"period": {
"unit": "MINUTES",
"interval": 1
}
},
"inputs": [
{
"search": {
"indices": [
"my-data-index"
],
"query": {
"size": 0,
"aggregations": {
"metric": {
"max": {
"field": "device_data.battery.voltage"
}
},
"terms_agg": {
"terms": {
"field": "device_data.id"
}
}
},
"query": {
"bool": {
"filter": [
{
"range": {
"datetime": {
"gte": "{{period_end}}||-1m",
"lte": "{{period_end}}",
"format": "epoch_millis"
}
}
}
]
}
}
}
}
}
],
"triggers": [
{
"query_level_trigger": {
"id": "dat6Yxxxxxxxxxxxxxx",
"name": "Test Trigger - Voltage over 4",
"severity": "1",
"condition": {
"script": {
"source": "return ctx.results[0].aggregations.metric.value == null ? false : ctx.results[0].aggregations.metric.value > 4",
"lang": "painless"
}
},
"actions": [
{
"id": "dqtxxxxxxxxxxxxxxxxx",
"name": "Notify Slack Test",
"destination_id": "hWcyyyyyyyyyyyyyyyyy",
"message_template": {
"source": "{\"channel\": \"GGGGGGG\", \"text\": \"Test\\n {{ctx}}\"}",
"lang": "mustache"
},
"throttle_enabled": false,
"subject_template": {
"source": "",
"lang": "mustache"
}
}
]
}
}
],
"ui_metadata": {
"schedule": {
"timezone": null,
"frequency": "interval",
"period": {
"unit": "MINUTES",
"interval": 1
},
"daily": 0,
"weekly": {
"tue": false,
"wed": false,
"thur": false,
"sat": false,
"fri": false,
"mon": false,
"sun": false
},
"monthly": {
"type": "day",
"day": 1
},
"cronExpression": "0 */1 * * *"
},
"monitor_type": "query_level_monitor",
"search": {
"searchType": "graph",
"timeField": "datetime",
"aggregations": [
{
"aggregationType": "max",
"fieldName": "device_data.battery.voltage"
}
],
"groupBy": [
"device_data.id"
],
"bucketValue": 1,
"bucketUnitOfTime": "m",
"filters": []
}
}
}
Curl to get Alerts
curl -XGET \
-H 'Content-Type: application/json' \
-u 'my-user:My-password' \
'https://os.fakedomain.com/_plugins/_alerting/monitors/alerts'
Response of Alerts CURL
{
"alerts": [
{
"acknowledged_time": null,
"action_execution_results": [
{
"action_id": "dqt6xxxxxxxxxxxxx",
"last_execution_time": 1693940207312,
"throttled_count": 0
}
],
"alert_history": [],
"end_time": null,
"error_message": null,
"finding_ids": [],
"id": "cNClZxxxxxxxxxxxxx",
"last_notification_time": 1693940207436,
"monitor_id": "d6t6Yxxxxxxxxxxxxxx",
"monitor_name": "Test Monitor - Overvoltage (Battery)",
"monitor_version": 14,
"related_doc_ids": [],
"schema_version": 4,
"severity": "1",
"start_time": 1693939256074,
"state": "ACTIVE",
"trigger_id": "dat6xxxxxxxxxxxxxxx",
"trigger_name": "Test Trigger - Voltage over 4",
"version": 17
}
],
"totalAlerts": 1
}
Request:
I’ve been reading documentation and doing multiple tests, with no luck. I believe that I should get more information on the related_doc_ids or finding_ids fields of the alert, but as you can see, they are empty. Despite my efforts, I haven’t been able to associate the alerts with the specific devices that generated them.
Could someone please guide me on how to extract which device_data.id generated the alert? I’m open to using sequential CURL requests to achieve this if necessary. Any help or suggestions would be greatly appreciated.
Thank you in advance for your assistance!
