We want a moniter created by checking for the memoryPercent value from the documents retrieved after running the query

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
v 2.7.0

Describe the issue:
We want a moniter created by checking for the memoryPercent value from the documents retrieved after running the query for the oc_xxxx_log index in our Opensearch.
once we get the results for the documents, we need to set a condition where memoryPercent > 3 that is present under the field “message” :

Currently we have exposed the memoryPercent field outside the container field.

I’m seeing this tough to configure and need help from someone how to get this done.

Configuration:

Relevant Logs or Screenshots:

2

You can create a per query monitor and use Extraction query editor, define your query DSL, and then create a trigger, the trigger condition can be like:

for (hit in ctx.results[0].hits.hits)
{
    if (hit._source.memoryPercent!=null && hit._source.memoryPercent>3) {
        return true;
}
}
return false;

,click the Preview condition response button to test the condition.

image
image1754×780 42.9 KB

3

Thanks [gaobinlong]… This looks good. I’ll configure and test using this method.