Hi Team,
I am trying to create a new thershold watcher alert for a value that is present inside the "message" field. But i was unable to get it right. Someone could please help to resolve the issue.
Below is the JSON template that i've tried
{
"trigger": {
"schedule": {
"interval": "2m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"applications-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 1,
"query": {
"bool": {
"must": [
{
"match": {
"message": {
"query": "heap.memory.used/total",
"operator": "and"
}
}
},
{
"range": {
"@timestamp": {
"gte": "now-3m"
}
}
}
]
}
},
"_source": [
"message",
"beat.name"
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total.heap.memory.used/total": {
"gt": 90
}
}
},
"actions": {
"email_me": {
"email": {
"profile": "standard",
"priority": "high",
"to": [
"xxx@abc.com"
],
"subject": "Test heap/memory",
"body": {
"text": "Message = {{ctx.payload.hits.hits.0._source.message}}"
}
}
}
},
"metadata": {
"color": "red"
},
"throttle_period_in_millis": 900000
}