How to compare sum aggregation value with a numeric data constant

Hi all,

First of all, sorry if my question is too simple but I'm relatively new to elastic.

I have to create a new rule in Kibana that checks every hour if the sum of the 'records' field of the documents in the index for a specific transaction (transaction H7A0) is greater than 150000. If the value is greater than that it should jump the rule to send an email.

I have created this query in devtools:

GET jdbc-db2-transaction-cpu-*/_search
{
"size": 0,
"query": {
"bool": {
"must": [
{
"terms": {
"transaction_id.keyword": ["H7A0"]
}
}
],
"filter": [
{
"range": {
"fecha": {
"gte": "now-60m"
}
}
}
]
}
},
"aggs": {
"transaction": {
"terms": {
"field": "transaction_id.keyword"
},
"aggs": {
"sum_H7A0_records": {
"sum": {
"field": "records"
}
}
}
}
}
}

And if I executed it I see I get the correct value in sum_H7A0_records field (in this case 211598

{
"took": 253,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": {
"value": 6,
"relation": "eq"
},
"max_score": null,
"hits":
},
"aggregations": {
"transaction": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "H7A0",
"doc_count": 6,
"sum_H7A0_records": {
"value": 211598
}
}
]
}
}
}

How can I do it so that in this case, for example, the rule returns 1 hit (not the 6 it returns) since the value is greater than 150000 and no hits if it's below 150000?

best regards

Borja

Hi Borja, and welcome to the community :wave: !

Try a bucket selector aggregation that filters the sum_H7A0_records bucket if the sum value is less than 150K:

...
       "sum_H7A0_records": {
          "sum": {
            "field": "records"
          }
        },
        "sum_records_gt_150k": {
          "bucket_selector": {
            "buckets_path": {
              "sumRecords": "sum_H7A0_records"
            },
            "script": "params.sumRecords > 150000"
          }
        }

Hope this helps!