Hi,
I search heartbeat-* indices when status is down and want to send message to telegram
My DSL is ,
GET heartbeat-7.7.0*/_search
{
"query": {
"bool": {
"must": [
{
"match": {
"monitor.status": "down"
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"gt": "now-5m"
}
}
}
]
}
},
"aggs": {
"alert": {
"terms": {
"field": "monitor.name"
}
}
}
}
And aggregations result is
"aggregations" : {
"alert" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"key" : "BC_Video_alert(BC)",
"doc_count" : 990
},
{
"key" : "AB_Video",
"doc_count" : 5
},
{
"key" : "SP_sport_alert(SABA)",
"doc_count" : 2
}
]
}
}
Is it passable to use watcher condition syntax, when aggregations.buckets.doc_count greater then a value
like syntax below, (but i don't know what correct syntax is)
ctx.payload.aggregations.buckets.doc_count > 20
then do some actions
thank you