# Alerting - % over XX Response Time

**URL:** <https://discuss.elastic.co/t/alerting-over-xx-response-time/130474>\
**Category:** Elasticsearch\
**Created:** [May 3, 2018, 2:19pm UTC](https://discuss.elastic.co/t/alerting-over-xx-response-time/130474 "2018-05-03T14:19:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kieron](https://avatars.discourse-cdn.com/v4/letter/k/65b543/32.png) [@Kieron](https://discuss.elastic.co/u/Kieron)\
**Post date:** [May 3, 2018, 2:19pm UTC](https://discuss.elastic.co/t/alerting-over-xx-response-time/130474/1 "2018-05-03T14:19:19Z")

</div>

Hi All!!

Need some help/guidance really! we've just got our ELK stack running - hosted in the cloud which has removed the need for the heavy cost of hosting internally out of our data centre.

I want to set-up an alert which will be when a certain request\_path has a response\_time over 2 seconds - this needs to be 1% or more requests of the total count in the last 10 minutes.

Hope that makes sense and hopefully is pretty simple to do.

thanks !  
Kieron

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 11, 2018, 10:53am UTC](https://discuss.elastic.co/t/alerting-over-xx-response-time/130474/2 "2018-05-11T10:53:45Z")

</div>

Hey,

without sharing the watch or the data model, this is going to be pretty hard, even to properly understand the use-case.

Check out the [percentile ranks aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-aggregations-metrics-percentile-rank-aggregation.html) to get the percentile of requests above two seconds. This aggregation could be inside of a terms agg, that aggregates on the request\_path (note that this may create many buckets if you have many request paths, so this is something you need to try out).

Play around with these aggregations, and see if there is search query that can show you the needed data. If that is the case, it is probably pretty easy to build a watch around it.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2018, 10:53am UTC](https://discuss.elastic.co/t/alerting-over-xx-response-time/130474/3 "2018-06-08T10:53:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.