How to show custom data in alerts messages in Kibana

[abhinav3 (Abhinav Rawat)]

Hi

I have a below data coming to elasticsearch:

{
	"Data": {
		"WiFiIP": "N/A",
		"signal_strength": "N/A",
		"signal_percent": 0,
		"signal_level": "N/A",
		"CPU": 10,
		"cpu_temp": 47.0,
		"Internet": true,
		"Publish msg count": 8631,
		"Created": "2021-08-30T06:15:07.789527",
		"DeviceId": "TX-D2-319",
		"UpTime": "2021-08-24T07:53:11"
	}
}

It has value of cpu temp. In Kibana I have set alert on cpu temp so that if t increases more than 65, I get an alert on Microsoft Teams with below message:

server temperature has increased more than 65*C.

I have many devices which are uploading data to elastisearch. I wanted to know how I can get the DeviceId in the alert message so that I know which device cpu temperature has increased?

[spinscale (Alexander Reelsen)]

Hey,

so the idea would be to run a query for documents > 65 degrees celsius in the last n minutes, but also have a terms aggregation, that aggregates on the DeviceId, so you can include the ids in your message.

See Terms aggregation | Elasticsearch Guide [7.14] | Elastic

Hope this helps!

--Alex

[abhinav3 (Abhinav Rawat)]

Hey spinscale

When creating a monitor, we do not have option to select DeviceId. Below is the image of how I am creating monitor

In above image I have selected the index pattern, then getting the count of documents for last 1hr where cpu is greater than 60. And in the trigger, I define this count to be lets say more than 10. So count of all document where cpu temp is more than 60, is greater than 10, I get an alert. I do not see any option for DeviceId here. Can you please explain, if I am moving in wrong direction. Thanks

[spinscale (Alexander Reelsen)]

On top of my head this will not work with the threshold watch, but you need to write the watch yourself (or use the advanced watch tab, which is just a JSON editor) when you create the watch.

[abhinav3 (Abhinav Rawat)]

Can you share any link to document sharing how to write your own watch. Thanks

[spinscale (Alexander Reelsen)]

See Create or update watch API | Elasticsearch Guide [7.14] | Elastic and even more the whole watcher documentation, starting with the getting started docs at Getting started with Watcher | Elasticsearch Guide [7.14] | Elastic

[abhinav3 (Abhinav Rawat)]

Hi spinscale

Thanks for sharing the links. I didn't knew we can create watch & alerts this way also. I will work on this and will close this topic. Will create any topic if any issues. Thanks