Alerts with the combination of multiple metrics

[vamsikrishna_medeti]

Hi, we started using onpremise Elastic Stack 7.9.0 for monitoring infrastructure and logs.

1. For alerting, how can I combine multiple metrics and create an alert?
   For ex to calculate the percentage of elasticsearch node free disk space:

(elasticsearch.node.stats.fs.summary.available.bytes / elasticsearch.node.stats.fs.summary.total.bytes) * 100

How can I convert this into an alert?

2. When I attach an jira action to the alert, when the alert condition is met, the jira is being created even if the jira was already created in the previous check.
   Is it possible to add the comment if the jira is already present?

@Ayush_Agrahari

[afharo (Alejandro Fernandez Haro)]

Hi @vamsikrishna_medeti,

At the moment, it's not possible to perform calculations in alerts. A possible solution would be to add an ingest pipeline step to add a new field with that calculation so that field is indexed and usable in visualisations and alerts.

Regarding the second question, I've created this issue on GitHub for the Alerting team to review that enhancement: https://github.com/elastic/kibana/issues/77319