# Having trouble understand Watcher condition

**URL:** <https://discuss.elastic.co/t/having-trouble-understand-watcher-condition/193376>\
**Category:** Elasticsearch\
**Created:** [August 1, 2019, 4:21pm UTC](https://discuss.elastic.co/t/having-trouble-understand-watcher-condition/193376 "2019-08-01T16:21:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [August 1, 2019, 4:21pm UTC](https://discuss.elastic.co/t/having-trouble-understand-watcher-condition/193376/1 "2019-08-01T16:21:00Z")

</div>

Hi,

I've recently begun testing the Watcher functionality and have been testing out a simple alert that will send an email to me whenever a persistent queue of Logstash exceeds over 1GB in Bytes.

However, i'm having trouble getting the condition right. It seems to send me alerts even though the queue never goes over 1GB in size. Here is the alert:

```
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "http": {
      "request": {
        "scheme": "http",
        "host": "84.19.155.71",
        "port": 9600,
        "method": "get",
        "path": "/_node/stats/pipelines",
        "params": {},
        "headers": {}
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.pipelines.main.queue.capacity.queue_size_in_bytes": {
        "gt": "1073741824"
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "supersecretmail@maimail.com"
        ],
        "subject": "Logstash Persistent Queue rising",
        "body": {
          "text": "Logstash Persistent Queue is rising. Max Queue Sise is {{ctx.payload.pipelines.main.queue.capacity.max_queue_size_in_bytes}}. Current Queue Size is {{ctx.payload.pipelines.main.queue.capacity.queue_size_in_bytes}}"
        }
      }
    }
  }
}

```

Here is an example from the simulation of the alert:

```
"condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.payload.pipelines.main.queue.capacity.queue_size_in_bytes": 176440702
        }
      }
    }

```

Since the resolved value is lower than the one i set, i expected it NOT to generate an alert. How come i still get the alerts?

---

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [August 2, 2019, 5:47am UTC](https://discuss.elastic.co/t/having-trouble-understand-watcher-condition/193376/2 "2019-08-02T05:47:02Z")

</div>

I can confirm that the issue has NOT been resolved by removing and adding the alert again.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 2, 2019, 5:50am UTC](https://discuss.elastic.co/t/having-trouble-understand-watcher-condition/193376/3 "2019-08-02T05:50:21Z")

</div>

> [@victor.nilsson](#):
>
> "gt": "1073741824"

Why are you specifying this as a string? Will that not cause a string based comparison rather than a numerical one?

---

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [August 2, 2019, 6:12am UTC](https://discuss.elastic.co/t/having-trouble-understand-watcher-condition/193376/4 "2019-08-02T06:12:18Z")

</div>

Nice catch. I had no idea that surrounding the value in quotes would make it a string. That is probably the issue. I've removed the quotes and will check back to post the results.

EDIT: That was indeed the issue, Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2019, 6:12am UTC](https://discuss.elastic.co/t/having-trouble-understand-watcher-condition/193376/5 "2019-08-30T06:12:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.