Understanding loops and variable index in alerting

Plugins Alerting
1

Hello everyone.

I am new to world of ELK stacks and its alerting solutions.

In my current project, I have created a query with a variable number of buckets. Inside these buckets I have several values.

For example, each bucket has:

  • Queue: 36
  • AverageQueue: 27
  • Name: “some_name”

Among other values not yet in use.

I have created a for loop that compares Queue with AverageQueue for every bucket in a simple way like this.

boolean result;
int index = new int [number_of_bucket];

for (…){

result = Queue>AverageQueue;
if (result == true){
index[i] = i;
}
}

My questions are: Since the for loop will do this comparison for all the buckets, will the alert return TRUE if any of queue values are bigger than average queue, or will it only return TRUE if the last comparison is TRUE?

Additionally, I am saving the bucket number i in index. Can I use index somehow in the message for the alerts?

Thank you for your time.

2

you cloud do something like this

ctx.results[0].transform = [:];
ctx.results[0].transform.high_queue_hosts = ctx.results[0].aggregations.Host.buckets.stream().filter( your condition).map(t → {return [‘host’: t.key, ‘queue_size’: t.queue_size.value ]}).collect(Collectors.toList())

and the you can use ctx.results[0].transform.high_queue_hosts in the actions section of your alert

1 Like
3

Thank you. I shall do some testing with this solution.

4

I managed to correct the syntax, but I now have a different error.

I believe the mapping is not working.

 "caused_by" : {
    "type" : "wrong_method_type_exception",
    "reason" : "cannot convert MethodHandle(Stream,Predicate)Stream to (Object,boolean)Object"
  }
5

After some confusion, and lack of code syntax, I managed to get some results with your approach.

Thank you very much, I will now try to manipulate the filters and what not and see if I achieve what I want.

6

Ok, I can’t seem to understand how the filter works.

Could you provide me an example?

Thank you.

7 
"query": {
          "size": 100,
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "FieldA": {
                      "value": "ValueA"
                    }
                  }
                },
                {
                  "term": {
                    "FieldB": {
                      "value": "ValueB"
                    }
                  }
                },
                {
                  "range": {
                    "Timestamp": {
                      "from": "now-35m/m",
                      "to": "now-5m/m"
                    }
                  }
                }
              ],
              "filter": [
                {
                  "exists": {
                    "field": "FieldC"
                  }
                }
              ]
            }
          }
1 Like