How to express Watcher condition on a field which has a numeric key (which has a decimal point in it)?

Elastic Stack Elasticsearch
1

Hi I am trying to set a condition for a watch that looks at a percentile of the response time of the API. The problem is that the field I need to look at in the tree has the value of "90.0" since this is how ES returns percentile values.


I have tried all combinations even using ['90.0'] to no avail. Problem is I cannot use something like this: [note I was able to change the agg name from "1" to "nth" but cannot do the same with the percentile]

How can I set this watch? I cannot find anyway, appreciate your help.

2

the below worked for me:

"input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "logstash-syslog-*" ], "types": [], "body": { "size": 0, "aggs": { "percentiles": { "percentiles": { "field": "my_numeric_field", "percents": [ 1, 5, 25, 50, 75, 95, 99 ] } } } } } } }, "condition": { "script": { "inline": "if (ctx.payload.aggregations.percentiles.values[\"99.0\"] > 0) return true;return false;" } }

3

Ali, it appears that implementing the same check using watcher compare is not working, one of our developer found out and it is most likely a bug. using scripting for now is a valid workaround.

4

Thank you!

Do I need to enable scripting? Because it is not enabled.

5

Hi Aliostad,

For the example that Antonio shared, you do need to enable scripting.

However, it's easy to make the percentiles aggregation return it's results in a slightly different format that you can use with the compare condition. If you add "keyed":true to the percentiles aggregation, the results will come back in an array with keys and values, which are easy to parse.

In fact, I demonstrated doing this in a Webinar in July :slight_smile: You can skip to around 30:00 to see the example an how I used it:

https://www.elastic.co/webinars/watcher-practical-alerting-for-elasticsearch

Hope that helps!

Steve

6

Awesome!! Thanks a lot.
And I think you meant "keyed":false but I got it!

Cheers