Detecting shifts in count in ELK with field

[waqark3389]

Hi,
I have some data inside 6.3 ELK. I wanted to monitor a particular field called 'hostname' and the count of this field over time (for example past 24 hours), which is easy enough to do.
However is there a way to alert or show in a graph when a count increases by a large percentage in the past 1 hour for example.

To illustrate, I have a steady count of docs in ES, at 00:00 its 50 docs, at 01:00 its 100 docs at 02:00 its 120 docs and so on. What I want to monitor is if the count jumps over 100% in one hour.
Basically I want to detect higher number of requests than normal.
I hope I explained this well, please let me know if any more info required...

[chandra0651 (Chandra Reddy Kosna)]

You can always use watcher for notification to trigger an email if the specific query returns more than expected count, but if you want to keep track on previous count and the present count i am not sure how to do it. but if you have fixed count and you want to get notified when the count got exceeded you can configure the watcher and below config might help you out.

> {
>   "trigger": {
>     "schedule": {
>       "interval": "1h"
>     }
>   },
>   "input": {
>     "search": {
>       "request": {
>         "search_type": "query_then_fetch",
>         "indices": [
>           "index"
>         ],
>         "types": [],
>         "body": {
>           "size": 0,
>           "query": {
>             "query_string": {
>               "query": "query AND @timestamp:[now-1h TO now]"
>             }
>           }
>         }
>       }
>     }
>   },
>   "condition": {
>     "compare": {
>       "ctx.payload.hits.total": {
>         "gt": Count at which you want to trigger alert
>       }
>     }
>   },
>   "actions": {
>     "send_email": {
>       "throttle_period_in_millis": 60000,
>       "email": {
>         "profile": "standard",
>         "to": [
>           
>         ],
>         "subject": "",
>         "body": {
>           "text": ""
>         }
>       }
>     }
>   }
}

[waqark3389]

Watcher is a paid for item and I don't have it