# Alerting on forecast
**URL:** https://discuss.elastic.co/t/alerting-on-forecast/254100
**Category:** Elasticsearch
**Tags:** elastic-stack-machine-learning, elastic-stack-alerting
**Created:** [November 3, 2020, 4:39am UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100 "2020-11-03T04:39:26Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)
#### Post date: [November 3, 2020, 4:39am UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100/1 "2020-11-03T04:39:26Z")
Hi, im trying to alert when the forecast prediction value is greater than 95, I need to get the hostname (partition\_value) and the time when the value surpass the treshold of 95, I currently can get the value and the partition\_field\_value, but I cant get the time.
```auto
GET .ml-anomalies-custom-prediction*/_search
{
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"timestamp": {
"gte": "now",
"lte": "now+4d",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
},
"aggs": {
"hostname": {
"terms": {
"field": "partition_field_value"
},
"aggs": {
"metricAgg": {
"avg": {
"field": "forecast_prediction"
}
}
}
}
}
}
```
this is the response of the query:
```auto
"aggregations" : {
"hostname" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 684288,
"buckets" : [
{
"key" : "SitRecove",
"doc_count" : 1152,
"metricAgg" : {
"value" : 6.627173770333747
}
},
{
"key" : "RACCO",
"doc_count" : 1152,
"metricAgg" : {
"value" : 1.1092647238975397
}
}
```
I know that the time field in a ML index is "timestamp" but I dont know how to agreggate it ...... how I can get the time?
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [November 3, 2020, 7:47am UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100/2 "2020-11-03T07:47:43Z")
Did you tried `min` on timestamp to get the start?
However in the description you say:
> [@ElasticLiver](#):
>
> I need to get the hostname (partition\_value) and the time when the value surpass the treshold of 95,
This does not correspond to the search you do. If you want the exact timestamp you should not build an average but e.g. use [`filter`](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filter-aggregation.html) with a range query (`>95`). As sub aggregation of the `filter` I would use `min` to get the start timestamp.
---
### Author:  [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)
#### Post date: [November 3, 2020, 1:10pm UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100/3 "2020-11-03T13:10:38Z")
I think the condition takes care of that
```auto
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.metricAgg.value > params.threshold) { return true; } return false;",
"params": {
"threshold": 95
}
}
```
The query is based on the one that the GUI creates, so I asume is the best way
going back to my questionn, i just want to get the time, I have tried nesting the agregation in the hostname agg, but you cannot nest another agg when you use AVG, i have tried the time agg next to the hostname agg, but the response is confusing, and the timestamp is apart from the other data (partition\_field\_value and forecast\_prediction)
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [November 3, 2020, 1:40pm UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100/4 "2020-11-03T13:40:48Z")
Why do you want to use average in the first place? In your requirement you say:
> [@ElasticLiver](#):
>
> get the hostname (partition\_value) and the time when the value surpass the treshold of 95
Think about it, when you have an average, it's reduced to 1 value, hence there aren't any timestamps to choose from, but just 1.
Right now, you fire the alert when the average of the next 4 days is above 95. This does not fit the requirement you set.
---
### Author:  [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)
#### Post date: [November 3, 2020, 8:05pm UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100/5 "2020-11-03T20:05:27Z")
Any suggestion on the type of query,?
---
### Author:  [@Hendrik\_Muhs](https://discuss.elastic.co/u/Hendrik_Muhs)
#### Post date: [November 4, 2020, 8:42am UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100/6 "2020-11-04T08:42:12Z")
This query should return all hosts that breach the limit.
Note: It reports all hosts, but only the ones where `timestamp != null` breach the threshold in the next 4 days.
```auto
GET .ml-anomalies-custom-prediction*/_search
{
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"timestamp": {
"gte": "now",
"lte": "now+4d",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
},
"aggs": {
"hostname": {
"terms": {
"field": "partition_field_value"
},
"aggs": {
"overLimit": {
"filter": {
"range": {
"forecast_prediction": {
"gte": 95
}
}
},
"aggs": {
"timestamp": {
"min": {
"field": "timestamp"
}
}
}
}
}
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 2, 2020, 8:42am UTC](https://discuss.elastic.co/t/alerting-on-forecast/254100/7 "2020-12-02T08:42:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.