# Alert triggered without any buckets in aggregation

**URL:** <https://discuss.elastic.co/t/alert-triggered-without-any-buckets-in-aggregation/207682>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [November 13, 2019, 10:32am UTC](https://discuss.elastic.co/t/alert-triggered-without-any-buckets-in-aggregation/207682 "2019-11-13T10:32:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![\_heiko](https://avatars.discourse-cdn.com/v4/letter/_/f19dbf/32.png) [@\_heiko](https://discuss.elastic.co/u/_heiko)\
**Post date:** [November 13, 2019, 10:32am UTC](https://discuss.elastic.co/t/alert-triggered-without-any-buckets-in-aggregation/207682/1 "2019-11-13T10:32:43Z")

</div>

Hi,  
I'm trying to build an alert that goes off when an instance of a service skipped 10 heartbeats within the last minute. I'm using the following adapted version of what I found in [another post](https://discuss.elastic.co/t/alert-on-repeated-ping-failures/138981/2).  
I am aggregating using a script, as there's two instances per `monitor.name` (service name) which can be separated by including `observer.geo.name`. Once the alert goes off, I receive a Slack message.

```auto
{
"trigger": {
  "schedule": {
    "interval": "1m"
  }
},
"input": {
  "search": {
    "request": {
      "search_type": "query_then_fetch",
      "indices": [
        "heartbeat-*"
      ],
      "rest_total_hits_as_int": true,
      "body": {
        "size": 0,
        "query": {
          "bool": {
            "must": [
              {
                "match": {
                  "monitor.status": {
                    "query": "down"
                  }
                }
              }
            ],
            "filter": [
              {
                "range": {
                  "@timestamp": {
                    "from": "now-1m"
                  }
                }
              }
            ]
          }
        },
        "aggregations": {
          "monitor_and_geo_names": {
            "terms": {
              "script": "doc['monitor.name'].value + ' at ' + doc['observer.geo.name'].value",
              "min_doc_count": 10,
              "order": {
                "_key": "asc"
              }
            }
          }
        }
      }
    }
  }
},
"condition": {
  "compare": {
    "ctx.payload.hits.total": {
      "gt": 0
    }
  }
},
"actions": {
  "notify-slack": {
    "throttle_period_in_millis": 600000,
    "slack": {
      "account": "monitoring",
      "message": {
        "from": "Health Alert",
        "text": "Missing heartbeats for following host(s):",
        "dynamic_attachments": {
          "list_path": "ctx.payload.aggregations.monitor_and_geo_names.buckets",
          "attachment_template": {
            "color": "warning",
            "title": "{{key}}",
            "text": "Missing heartbeats (last minute): {{doc_count}}"
          }
        }
      }
    }
  }
}
}

```

The problem is that the alert is triggered, even though the aggregation did not yield any buckets (e.g. an instance skipped just a single heartbeat in the last minute). The fact that I don't receive any attachements to my Slack message indicates, that there are no buckets. Why is the alert then triggered anyway? Am I missunderstanding how `min_doc_count` in the aggregation and `ctx.payload.hits.total` in my compare condition work together?

---

<div class="post-metadata">

**Author:** ![\_heiko](https://avatars.discourse-cdn.com/v4/letter/_/f19dbf/32.png) [@\_heiko](https://discuss.elastic.co/u/_heiko)\
**Post date:** [November 13, 2019, 12:53pm UTC](https://discuss.elastic.co/t/alert-triggered-without-any-buckets-in-aggregation/207682/2 "2019-11-13T12:53:09Z")

</div>

Ok, so after experimenting with the query a bit more, it seems like the count of total hits is the count of all matching documents regardless of any aggregation, i.e. `min_doc_count` in the aggregation does not affect it at all.  
Then my question would be, how do I access the number of buckets for comparison in the condition section, so that the alert is only triggered if there are buckets?

---

<div class="post-metadata">

**Author:** ![\_heiko](https://avatars.discourse-cdn.com/v4/letter/_/f19dbf/32.png) [@\_heiko](https://discuss.elastic.co/u/_heiko)\
**Post date:** [November 13, 2019, 5:23pm UTC](https://discuss.elastic.co/t/alert-triggered-without-any-buckets-in-aggregation/207682/3 "2019-11-13T17:23:27Z")

</div>

Seems to work with a scripted condition like so:

```auto
"condition": {
    "script": {
      "source": "return ctx.payload.aggregations.monitor_and_geo_names.buckets.size() > 0",
      "lang": "painless"
    }
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2019, 5:23pm UTC](https://discuss.elastic.co/t/alert-triggered-without-any-buckets-in-aggregation/207682/4 "2019-12-11T17:23:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.