I am trying to trigger alert with “Per bucket monitor”.
I would like to loop on bucket “host” and generate Alert if the (current GarbageCollector - previous GarbageCollector) is gte 3000.
For this calculation i use “serial_diff” bucket. Here my request
{
“size”: 0,
“query”: {
“bool”: {
“must”: [
{
“match”: {
“3DX.composant”: {
“query”: “3DSpace”,
“operator”: “AND”,
“prefix_length”: 0,
“max_expansions”: 50,
“fuzzy_transpositions”: true,
“lenient”: false,
“zero_terms_query”: “NONE”,
“auto_generate_synonyms_phrase_query”: true,
“boost”: 1
}
}
},
{
“match”: {
“metric_path”: {
“query”: “3DX.jvm.GarbageCollectorScavenge.CollectionTime”,
“operator”: “AND”,
“prefix_length”: 0,
“max_expansions”: 50,
“fuzzy_transpositions”: true,
“lenient”: false,
“zero_terms_query”: “NONE”,
“auto_generate_synonyms_phrase_query”: true,
“boost”: 1
}
}
}
],
“filter”: [
{
“range”: {
“@timestamp”: {
“from”: “now-20s”,
“to”: “now”,
“include_lower”: false,
“include_upper”: true,
“boost”: 1
}
}
}
],
“adjust_pure_negative”: true,
“boost”: 1
}
},
“aggregations”: {
“host”: {
“terms”: {
“field”: “host.keyword”,
“size”: 10,
“min_doc_count”: 1,
“shard_min_doc_count”: 0,
“show_term_doc_count_error”: false,
“order”: [
{
“_count”: “desc”
},
{
“_key”: “asc”
}
]
},
“aggregations”: {
“Calendrier”: {
“date_histogram”: {
“field”: “@timestamp”,
“interval”: “10s”,
“offset”: 0,
“order”: {
“_key”: “asc”
},
“keyed”: false,
“min_doc_count”: 0
},
“aggregations”: {
“Value”: {
“sum”: {
“field”: “metric_value_number”
}
},
“serialdiff”: {
“serial_diff”: {
“buckets_path”: [
“Value”
],
“gap_policy”: “skip”,
“lag”: 1
}
}
}
}
}
}
}
}
And here following request answer
{
“_shards”: {
“total”: 1,
“failed”: 0,
“successful”: 1,
“skipped”: 0
},
“hits”: {
“hits”: ,
“total”: {
“value”: 4,
“relation”: “eq”
},
“max_score”: null
},
“took”: 2,
“timed_out”: false,
“aggregations”: {
“host”: {
“doc_count_error_upper_bound”: 0,
“sum_other_doc_count”: 0,
“buckets”: [
{
“doc_count”: 2,
“Calendrier”: {
“buckets”: [
{
“key_as_string”: “2022-10-19T16:29:50.000Z”,
“doc_count”: 1,
“Value”: {
“value”: 15369
},
“key”: 1666196990000
},
{
“key_as_string”: “2022-10-19T16:30:00.000Z”,
“serialdiff”: {
“value”: 0
},
“doc_count”: 1,
“Value”: {
“value”: 15369
},
“key”: 1666197000000
}
]
},
“key”: “xxxxxxxxxx1”
},
{
“doc_count”: 2,
“Calendrier”: {
“buckets”: [
{
“key_as_string”: “2022-10-19T16:29:50.000Z”,
“doc_count”: 1,
“Value”: {
“value”: 13934
},
“key”: 1666196990000
},
{
“key_as_string”: “2022-10-19T16:30:00.000Z”,
“serialdiff”: {
“value”: 0
},
“doc_count”: 1,
“Value”: {
“value”: 13934
},
“key”: 1666197000000
}
]
},
“key”: “xxxxxxxxxx”
}
]
}
}
}
How to manage the Trigger condition to be able to loop on host bucket and check if serialdiff.value if gte than 3000 ?
{
“buckets_path”: {
“”: "
},
“parent_bucket_path”: “host”,
“script”: {
“source”: “”,
“lang”: “painless”
},
“gap_policy”: “skip”
}
Thanks
Olivier