# ES DSL Query

**URL:** <https://discuss.elastic.co/t/es-dsl-query/212028>\
**Category:** Elasticsearch\
**Created:** [December 16, 2019, 3:39pm UTC](https://discuss.elastic.co/t/es-dsl-query/212028 "2019-12-16T15:39:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ghaith\_Haddad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghaith_haddad/32/49288_2.png) [@Ghaith\_Haddad](https://discuss.elastic.co/u/Ghaith_Haddad)\
**Post date:** [December 16, 2019, 3:39pm UTC](https://discuss.elastic.co/t/es-dsl-query/212028/1 "2019-12-16T15:39:56Z")

</div>

So im trying to make a monitor on Alerts for Kibana OSS but im not sure how to search through the data/logs that i have using the extraction query. This is an example of one of the hits:

```
{
    "_shards": {
        "total": 1,
        "failed": 0,
        "successful": 1,
        "skipped": 0
    },
    "hits": {
        "hits": [
            {
                "_index": "logstash-2019.12.16",
                "_type": "_doc",
                "_source": {
                    "@timestamp": "2019-12-16T00:20:36.854Z",
                    "system": {
                        "filesystem": {
                            "total": 20749807616,
                            "device_name": "/dev/nvme0n1p1",
                            "mount_point": "/",
                            "free_files": 2360019,
                            "available": 14942003200,
                            "files": 2560000,
                            "used": {
                                "pct": 0.2793,
                                "bytes": 5791027200
                            },
                            "free": 14958780416,
                            "type": "ext4"
                        }
                    }

```

what would be the correct syntax to search/filter for "device name" and "pct"? what im trying to do exactly is for every device name if the value of pct is greater than 0.75 then it would alert me.

the documentation on the ELK site is just really hard to understand!

Thank you in advance for any help or guidance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2020, 3:40pm UTC](https://discuss.elastic.co/t/es-dsl-query/212028/2 "2020-01-13T15:40:16Z")

</div>

Closed on January 13, 2020, 3:40pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.