Action variable context.threshold doesn't work for warning threshold

Elastic Observability
1

Here's a rule I've setup. It has one condition with 2 thresholds (warning and alert)

image
image926×662 43.3 KB

When I trigger the warning criteria for here's the output:

context.threshold:
{"condition0":[150]}
context.value:
{"condition0":8}
context.metric:
{}

The issue I'm having is that condition0 always reports the alert threshold value not the warning threshold value. It should be 1 and not 150.

Even context.reason returns the wrong string:
Document count is greater than a threshold of 150 (current value is 8) for /api/marketplace/personalization_quiz/quiz/v1

This seems like a bug.

2

Hi Govind,

Thanks for taking the time to report this issue. This is indeed a known bug.

Can you confirm which version of the stack you are running please?

The context.reason message will be fixed in the 8.5.0 release and back ported to the 8.4.x release.

For the context.threshold value though, the fix still needs to be defined and worked on. But in the meantime, a workaround is to hardcode the warning threshold value directly in the action template you are using, and not rely on the {{context.threshold}} templating tag.

I hope this solves your issue.

Kevin