Can set the Watcher with Time period in 2 Codition

Elastic Stack Elasticsearch
1

Topic : How to set Watcher to support 2 condition on 1 day??

Time 00.00 - 06.00 check-in Condition 1

"condition": {
"compare": {
  "ctx.payload.hits.total": {
    "gte": 10
  }
}

Time 06.01-23.59 Check-in Condition 2

"condition": {
"compare": {
  "ctx.payload.hits.total": {
    "gte": 50
  }
}

Watcher can be support in case or not ?
or anyone can share the knowledge of how to set in this case.

2

Hi, two solutions come to my mind:

  • Create 2 independent watcher alerts with the desired scheduling and condition for each one. More verbose but simpler to maintain.

  • Use only one alert with a script condition instead of a simple compare. That enables you to:

    • Use any data inside the watcher context (input search results, trigger dates, etc)
    • Set multiple conditions
      ( X >=50 and ctx.whatever_time_reference_you_like >= time_init_1 and ctx.whatever_time_reference_you_like <= time_end_1 ) OR (X>=10 and ctx.whatever_time_you_like >= time_init_2 and ...)

As you imagine, the latest one won't be beautiful at all...

3

Hey,

in addition you can have conditions on a per action base. So you could trigger action1 (i.e. send a slack message) for your first condition and action2 (i.e. send an email) with the second condition.

Would that help your use-case?

--Alex

4

Hi Sinscale
thank you for update
I mean check up same error code.
when payload.hits.total greater than 10 @time 00.00 - 06.00 and payload.hits.total greater than 50 @time 06.01 - 23.59

same error code check but different time of the day

5

using a script based condition you can execute all the logic you want within a condition and also take the current time into account by utilizing ctx.trigger.triggered_time

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.