# Advanced Watch calculate buckets
**URL:** https://discuss.elastic.co/t/advanced-watch-calculate-buckets/198063
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [September 4, 2019, 2:18pm UTC](https://discuss.elastic.co/t/advanced-watch-calculate-buckets/198063 "2019-09-04T14:18:26Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Amaral](https://discuss.elastic.co/u/Amaral)
#### Post date: [September 4, 2019, 2:18pm UTC](https://discuss.elastic.co/t/advanced-watch-calculate-buckets/198063/1 "2019-09-04T14:18:26Z")
I want to create a advanced watch wich count a specific operation of specific service during more than 1 second to execute. If the number of cases is greater than 1% of total of cases, the watch send a alert. Ex: (duration / total \> 0,01 )
My goal is to be able to divide the number of cases that during more than 1s by total of cases to obtain the percentage.
I did a query with the two aggs that i need for the division, but i can't reach the calculate part.
Is it even possible? If so, how?
My query:
> GET test-\*/\_search?size=0
> {
> "query": {
> "term": {
> "Service.keyword": "se"
> }
> },
> "aggs": {
> "total": {
> "filter": {
> "term": {
> "Operation.keyword": "op"
> }
> },
> "aggs": {
> "duration": {
> "filter": {
> "range": {
> "Duration": {
> "gte": 1000
> }
> }
> }
> }
> }
> }
> }
> }
Result:
> {
> "took" : 328,
> "timed\_out" : false,
> "\_shards" : {
> "total" : 52,
> "successful" : 52,
> "skipped" : 0,
> "failed" : 0
> },
> "hits" : {
> "total" : 334,
> "max\_score" : 0.0,
> "hits" :
> },
> "aggregations" : {
> "total" : {
> "doc\_count" : 296,
> "duration" : {
> "doc\_count" : 19
> }
> }
> }
> }
---
### Author:  [@Amaral](https://discuss.elastic.co/u/Amaral)
#### Post date: [September 16, 2019, 11:34am UTC](https://discuss.elastic.co/t/advanced-watch-calculate-buckets/198063/2 "2019-09-16T11:34:45Z")
I already found the solution!
Solution:
> GET test-\*/\_search?size=0
> {
> "query": {
> "bool": {
> "must": [{
> "term": {
> "Service.keyword": "se"}},
> {"term": {"Operation.keyword": "op"}},
> {"range": {"@timestamp": {"gte": "now-1h"}}}]}},
> "aggs": {
> "result": {
> "filters": {
> "filters": {
> "ALL": {
> "match\_all": {}}}},
> "aggs": {
> "TOTAL": {
> "filter": {
> "term": {
> "Service.keyword": "OTT/Service"}},
> "aggs": {
> "total\_count": {
> "value\_count": {
> "field": "Operation.keyword"}}}},
> "partial": {
> "filter": {
> "range": {
> "Duration": {
> "gte": 1000,
> "lte": null}}},
> "aggs": {
> "partial\_count": {
> "value\_count": {
> "field": "Operation.keyword"}}}},
> "convert\_ratio": {
> "bucket\_script": {
> "buckets\_path": {
> "total": "TOTAL\>total\_count",
> "partial": "partial\>partial\_count"},
> "script": "params.partial/params.total"}}}}}}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 14, 2019, 11:34am UTC](https://discuss.elastic.co/t/advanced-watch-calculate-buckets/198063/3 "2019-10-14T11:34:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.