hi
I have created following watcher by following https://cinhtau.net/2017/06/19/es-nodes-mem_watch/ I had to edit few stuff to make it work for ELK 7
{
"trigger": {
"schedule": {
"interval": "6h"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
".monitoring-es-7*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"timestamp": {
"gte": "now-2m",
"lte": "now"
}
}
}
]
}
},
"aggs": {
"minutes": {
"date_histogram": {
"field": "timestamp",
"calendar_interval": "1h"
},
"aggs": {
"nodes": {
"terms": {
"field": "source_node.name"
},
"aggs": {
"memory": {
"max": {
"field": "node_stats.jvm.mem.heap_used_percent"
}
}
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "return ctx.payload.aggregations.minutes.buckets.stream().anyMatch(b -> b.nodes.buckets.stream().anyMatch(x -> x.memory.value > 50))",
"lang": "painless"
}
},
"actions": {
"send_mem_warning": {
"transform": {
"script": {
"source": "def latest = ctx.payload.aggregations.minutes.buckets[-1]; return latest.nodes.buckets.stream().filter(item -> item.memory.value >= ctx.metadata.threshold).collect(Collectors.toList());",
"lang": "painless"
}
},
"email": {
"profile": "standard",
"from": "XXXXXXXXX",
"reply_to": [
"XXXXXXXX"
],
"to": [
"XXXXXXXXXX"
],
"subject": "Watcher Notification - HIGH MEMORY USAGE",
"body": {
"html": {
"id": "mem-watch-warning"
}
}
}
}
},
"metadata": {
"threshold": 50
}
}
I added mustache template as per that doc. When i execute the watcher i get following output (from log)
"email" : {
"account" : "exchange_account",
"message" : {
"id" : "send_mem_warning_mem-watch-mustache_1c138b80-c812-46ec-b6c0-449aa6536765-2020-02-25T03:00:53.683535Z",
"from" : "XXXXXXXXXXXXXX",
"reply_to" : [
"XXXXXXXXX"
],
"sent_date" : "2020-02-25T03:00:54.338305Z",
"to" : [
"XXXXXXXXX"
],
"subject" : "Watcher Notification - HIGH MEMORY USAGE",
"body" : {
"html" : "mem-watch-warning"
}
}
}
}
my email has only following.
mem-watch-warning
So some where in forum i read painelss and mustache dont work together. But i lost that thread. So is that true ? if yes how do i fix my issue ?