# Advanced Watch of serial diff of value

**URL:** <https://discuss.elastic.co/t/advanced-watch-of-serial-diff-of-value/178925>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 29, 2019, 12:08pm UTC](https://discuss.elastic.co/t/advanced-watch-of-serial-diff-of-value/178925 "2019-04-29T12:08:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![6tUBp3gwd9Zp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6tubp3gwd9zp/32/45240_2.png) [@6tUBp3gwd9Zp](https://discuss.elastic.co/u/6tUBp3gwd9Zp)\
**Post date:** [April 29, 2019, 12:08pm UTC](https://discuss.elastic.co/t/advanced-watch-of-serial-diff-of-value/178925/1 "2019-04-29T12:08:25Z")

</div>

I want to create an advanced watcher that monitors a value and if that value does make a jump greater than x then i want to be informed. My guess was to do this with a serial\_diff of the average aggregation of that value and compare that to a treshold but i cant get it working. Is it even possible? And if so, how?

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [April 29, 2019, 12:53pm UTC](https://discuss.elastic.co/t/advanced-watch-of-serial-diff-of-value/178925/2 "2019-04-29T12:53:31Z")

</div>

Moved to Elasticsearch topic as this is really an ES question.

---

<div class="post-metadata">

**Author:** ![6tUBp3gwd9Zp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/6tubp3gwd9zp/32/45240_2.png) [@6tUBp3gwd9Zp](https://discuss.elastic.co/u/6tUBp3gwd9Zp)\
**Post date:** [April 30, 2019, 5:50am UTC](https://discuss.elastic.co/t/advanced-watch-of-serial-diff-of-value/178925/3 "2019-04-30T05:50:41Z")

</div>

So I solved it like this. Maybe it's helpful for others. Nevertheless other maybe better solutions are much appreciated.

```
{
"metadata": {
	"..."
},
"trigger": {
	"..."
},
"input": {
	"search": {
		"request": {
			"search_type": "query_then_fetch",
			"indices": ["...*"],
			"types": ["doc"],
			"body": {
				"size": 0,
				"aggs": {
					"1": {
						"max_bucket": {
							"buckets_path": "1-bucket>1-metric"
						}
					},
					"1-bucket": {
						"date_histogram": {
							"field": "robotime",
							"interval": "1h",
							"time_zone": "Europe/Berlin",
							"min_doc_count": 0
						},
						"aggs": {
							"avg_offset": {
								"avg": {
									"field": "property.gapMeasurementResultInMm.leftOffset"
								}
							},
							"1-metric": {
								"serial_diff": {
									"buckets_path": "avg_offset"
								}
							}
						}
					}
				},
				"query": {
					"..."
				},
			}
		}
	}
},
"condition": {
	"script": {
		"source": "if (ctx.payload.aggregations.1.value > params.threshold) { return true; } return false;",
		"lang": "painless",
		"params": {
			"threshold": 0.5
		}
	}
},
"actions": {
	"..."
}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 28, 2019, 5:59am UTC](https://discuss.elastic.co/t/advanced-watch-of-serial-diff-of-value/178925/4 "2019-05-28T05:59:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.