How to compare sum aggregation value with a numeric data constant

[Borja]

Hi all,

First of all, sorry if my question is too simple but I'm relatively new to elastic.

I have to create a new rule in Kibana that checks every hour if the sum of the 'records' field of the documents in the index for a specific transaction (transaction H7A0) is greater than 150000. If the value is greater than that it should jump the rule to send an email.

I have created this query in devtools:

GET jdbc-db2-transaction-cpu-*/_search
{
  "size": 0,
     "query": {
         "bool": {
            "must": [
              {
                "terms": {
                  "transaction_id.keyword": ["H7A0"]
                }
              }
            ],
            "filter": [
                {
                  "range": {
                    "fecha": {
                      "gte": "now-60m"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
             "transaction": {
             "terms": {
                "field": "transaction_id.keyword"
             },
               "aggs": {
               "sum_H7A0_records":  {
                   "sum": {
                   "field": "records"
                   }
                }
               }
             }
		   }
}

And if I executed it I see I get the correct value in sum_H7A0_records field (in this case 211598

{
  "took": 253,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 6,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "transaction": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "H7A0",
          "doc_count": 6,
          "sum_H7A0_records": {
            "value": 211598
          }
        }
      ]
    }
  }
}

How can I do it so that in this case, for example, the rule returns 1 hit (not the 6 it returns) since the value is greater than 150000 and no hits if it's below 150000?

best regards

Borja

[demjened (Adam Demjen)]

Hi Borja, and welcome to the community !

Try a bucket selector aggregation that filters the sum_H7A0_records bucket if the sum value is less than 150K:

...
       "sum_H7A0_records": {
          "sum": {
            "field": "records"
          }
        },
        "sum_records_gt_150k": {
          "bucket_selector": {
            "buckets_path": {
              "sumRecords": "sum_H7A0_records"
            },
            "script": "params.sumRecords > 150000"
          }
        }

Hope this helps!

[Borja]

Hi Demjened,

it worked. thank you very much.

regards