# Create a watcher alert - extract a field and to compare

**URL:** https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [September 11, 2022, 11:51am UTC](https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140 "2022-09-11T11:51:46Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sree3](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@sree3](https://discuss.elastic.co/u/sree3)
#### Post date: [September 11, 2022, 11:51am UTC](https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140/1 "2022-09-11T11:51:46Z")

</div>

Hi Team,

I am trying to create a new thershold watcher alert for a value that is present inside the "message" field. But i was unable to get it right. Someone could please help to resolve the issue.

Below is the JSON template that i've tried

```auto
{
  "trigger": {
    "schedule": {
      "interval": "2m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "applications-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 1,
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "message": {
                      "query": "heap.memory.used/total",
                      "operator": "and"
                    }
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-3m"
                    }
                  }
                }
              ]
            }
          },
          "_source": [
            "message",
            "beat.name"
          ]
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total.heap.memory.used/total": {
        "gt": 90
      }
    }
  },
  "actions": {
    "email_me": {
      "email": {
        "profile": "standard",
        "priority": "high",
        "to": [
          "xxx@abc.com"
        ],
        "subject": "Test heap/memory",
        "body": {
          "text": "Message = {{ctx.payload.hits.hits.0._source.message}}"
        }
      }
    }
  },
  "metadata": {
    "color": "red"
  },
  "throttle_period_in_millis": 900000
}

```

---

<div class="post-metadata">

### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [September 12, 2022, 10:57am UTC](https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140/2 "2022-09-12T10:57:06Z")

</div>

This implies you haven't parsed your data properly into fields. You can either adjust your [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html) or create a [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html) in the meantime to get the value of `heap.memory.used/total`

---

<div class="post-metadata">

### Author: ![sree3](https://avatars.discourse-cdn.com/v4/letter/s/22d042/32.png) [@sree3](https://discuss.elastic.co/u/sree3)
#### Post date: [September 15, 2022, 3:10am UTC](https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140/3 "2022-09-15T03:10:52Z")

</div>

Thanks @richcollier . I shall try adjust the ingest.  
Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 13, 2022, 3:10am UTC](https://discuss.elastic.co/t/create-a-watcher-alert-extract-a-field-and-to-compare/314140/4 "2022-10-13T03:10:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.