Per bucket monitor, metric values get in email alert with mustache -> how?

Plugins Alerting
1

Hi there,
Have a “per bucket monitor” active here.
The values of “group by”, in this case the hostnames are displayed correctly.
I also want to display the metrics values matching the hostname. How do i do that here ?

I would like to extract the value “avg_cpu_usage_user”, how do i do that ?
query response:

    "aggregations": {
        "composite_agg": {
            "buckets": [
                {
                    "doc_count": 974,
                    "key": {
                        "tags.host": "SFG24"
                    },
                    "avg_cpu_usage_user": {
                        "value": 5.083928505579631
                    }
                },
                {
                    "doc_count": 150,
                    "key": {
                        "tags.host": "ingest01"
                    },
                    "avg_cpu_usage_user": {
                        "value": 60.62625534057617
                    }
                },
                {
                    "doc_count": 180,
                    "key": {
                        "tags.host": "os-dash01"
                    },
                    "avg_cpu_usage_user": {
                        "value": 0.3969384260475636
                    }
                }
            ],
            "after_key": {
                "tags.host": "os-dash01"
            }
        }
    }
}

Email-Template:

Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.
  - Trigger: {{ctx.trigger.name}}
  - Severity: {{ctx.trigger.severity}}
  - Period start: {{ctx.periodStart}}
  - Period end: {{ctx.periodEnd}}

  - Deduped Alerts:
  {{#ctx.dedupedAlerts}}
    * {{id}} : {{bucket_keys}}  {{avg_cpu_usage_user.value}}
  {{/ctx.dedupedAlerts}}

  - New Alerts:
  {{#ctx.newAlerts}}
    * {{id}} : {{bucket_keys}}  {{avg_cpu_usage_user.value}}
  {{/ctx.newAlerts}}

  - Completed Alerts:
  {{#ctx.completedAlerts}}
    * {{id}} : {{bucket_keys}} {{avg_cpu_usage_user.value}}
  {{/ctx.completedAlerts}}
2

Hi ,
Did anyone find a solution to this??

3

Pretty late to the party here, but you could try this. You can iterate through aggregations with Mustache, just like you can individual “hits”, by referencing the JSON structure like you would variables in an object-oriented programming language. I think this would work in a “per bucket monitor”. I know something like this works with a non-bucket monitor if you have aggregations in there.

{{#ctx.results. 0 .aggregations.composite_agg.buckets}}

- {{key.tags.host}} : {{avg_cpu_usage_user.value}}

{{/ctx.results. 0 .aggregations.composite_agg.buckets}}

4

Hi guys, did anyone find a solution to this? I had a similar use case.