# Creating alert for low disk space (any server had less than 200mb free space for the /mount/logs mount point))

**URL:** <https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [September 20, 2022, 10:23am UTC](https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769 "2022-09-20T10:23:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Madhu24](https://avatars.discourse-cdn.com/v4/letter/m/3be4f8/32.png) [@Madhu24](https://discuss.elastic.co/u/Madhu24)\
**Post date:** [September 20, 2022, 10:23am UTC](https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769/1 "2022-09-20T10:23:45Z")

</div>

Can anyome help to write how can write a scrit to trigger notification to a slack channel using below sample and how to add aggregations for this and conditon as well. Thanks  
{  
"trigger": {  
"schedule": "60m"  
}  
},  
"input":{  
"search":{  
"request": {  
"search\_type: "query\_then\_fetch",  
"indices": [  
"name-\*"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"size": 0,  
"query": {  
"bool" : {  
"must": [  
{  
"query\_string": {  
"query": agent.name:_prod_ AND metricset.name: "filesystem" AND system.filesystem.mount\_point:"/var/log""  
}  
},  
{  
"range": {  
"@timestamp" : {  
"from" : "now-5m",  
"to" : "now",  
"include\_lower" : true,  
"include\_upper" : true,  
}  
}  
}  
]  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare: {  
"ctx.payload.hits.total": {  
"gte": 3  
}  
}  
},  
"actions": {  
we are using slack channel for alert notification here  
}  
"transform": {  
"script": {  
"source": "def payload = ctx.payload; payload.interval\_start = Instant.ofEpochMilli(ctx.trigger.triggered\_time.getMills()).minusSeconds(minutes \* 60); return payload;",  
"lang": "painless"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2022, 10:24am UTC](https://discuss.elastic.co/t/creating-alert-for-low-disk-space-any-server-had-less-than-200mb-free-space-for-the-mount-logs-mount-point/314769/2 "2022-10-18T10:24:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.