# How to show Memory Usage is at values percent

**URL:** <https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [July 11, 2017, 6:58am UTC](https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585 "2017-07-11T06:58:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thanadol\_Thadasade](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)\
**Post date:** [July 11, 2017, 6:58am UTC](https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585/1 "2017-07-11T06:58:34Z")

</div>

Hi, @spinscale  
I'm having trouble with settings alerts for my memory usage. I'm using Metricbeat which is stashing only the memory metrics to Elasticsearch.

This is the JSON for the watch that I've configured:

> PUT \_xpack/watcher/watch/mem\_warning  
> {  
> "trigger": {  
> "schedule": {  
> "interval": "10m"  
> }  
> },  
> "input": {  
> "search": {  
> "request": {  
> "indices": [  
> "metricbeat-\*"  
> ],  
> "body": {  
> "size": 10,  
> "query": {  
> "bool": {  
> "filter": [  
> {  
> "range": {  
> "@timestamp": {  
> "from" : "now-7h"  
> }  
> }  
> },  
> {  
> "term": {  
> "metricset.name" : "memory"  
> }  
> },  
> {  
> "range": {  
> "system.memory.used.pct" : {  
> "from" : 0.75  
> }  
> }  
> }  
> ]  
> }  
> },  
> "aggs": {  
> "hosts": {  
> "terms": {  
> "field": "beat.hostname",  
> "size": 10  
> }  
> }  
> }  
> }  
> }  
> }  
> },  
> "condition" : {  
> "script" : "return ctx.payload.aggregations.hosts.buckets.size() \> 0"  
> },  
> "actions": {  
> "send\_email": {  
> "transform" : {  
> "script" : {  
> "inline": "return ['hosts' : ctx.payload.aggregations.hosts.buckets.stream().map(b -\> b.key).collect(Collectors.toList())]"  
> }  
> },  
> "email": {  
> "to": "thanadol.thad@wealth.co.th",  
> "subject": "Watcher Notification - HIGH MEMORY USAGE",  
> "body": "Hosts with HIGH MEMORY Usage (above 75%):\n\n{{ctx.payload.hosts}}\n\n Memory Usage is at: `...` %"  
> }  
> }  
> }  
> }

I'm following [Watching the watches: Writing, debugging and testing watches | Elastic Blog](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches) ,but it show one host.

![](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef4555505067639b6b8b3ee1f6556db94b401009.png)

**I need that outputs to show hosts and values.**  
Example.

> " Hosts with HIGH MEMORY USAGE (above 75%): **hosts1** Memory Usage is at: **80.65%** , **hosts2** Memory Usage is at: **87.13%**"  
> or  
> " Hosts with HIGH MEMORY USAGE (above 75%): **hosts1,hosts2,hosts3** Memory Usage is at: **80.65%, 87.13%, 76.01%**"

Thanks.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 11, 2017, 12:11pm UTC](https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585/2 "2017-07-11T12:11:20Z")

</div>

Hey,

I do not understand where your exact problem is at the moment. When you take a look at your aggregation, there is only an aggregation on the hostname, so this is the data you are getting from the search response. If you want to also get the memory usage, you may need to add another sub-aggregation that calculates `max` or `average` of the memory field in your data.

First start with the query, and only if that contains all the results, start writing a watch. The tricky part is usually the query, not the watch itself.

--Alex

---

<div class="post-metadata">

**Author:** ![Thanadol\_Thadasade](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)\
**Post date:** [July 12, 2017, 8:37am UTC](https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585/3 "2017-07-12T08:37:45Z")

</div>

thank for reply @spinscale  
if i used sub-aggregation avg or max  
Example

> ```
> "aggs": {
> "hosts": {
> "terms": {
> "field": "beat.hostname",
> "size": 10
> },
> "aggs": {
> "values": {
> "avg": {
> "field": "system.memory.used.pct"
> }
> }
> }
> }
> }
> 
> ```

**how to refer to sub-aggregation at action in body?**

Example condition and action

> "condition" : {  
> "script" : "return ctx.payload.aggregations.hosts.buckets.size() \> 0"  
> },  
> "actions": {  
> "send\_email": {  
> "transform" : {  
> "script" : {  
> "inline": "return ['hosts' : ctx.payload.aggregations.hosts.buckets.stream().map(b -\> b.key).collect(Collectors.toList())]"  
> }  
> },  
> "email": {  
> "to": "thanadol.thad@wealth.co.th",  
> "subject": "Watcher Notification - HIGH MEMORY USAGE",  
> "body": "Hosts with HIGH MEMORY Usage (above 75%):\n\n{{ctx.payload.hosts}}\n\n  
> Memory Usage is at: `...` % \n\n  
> at times: {{ctx.trigger.triggered\_time}} \n\n"  
> }  
> }  
> }

thanks.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 12, 2017, 12:43pm UTC](https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585/4 "2017-07-12T12:43:16Z")

</div>

Hey.

how about this transform?

```auto
    "transform": {
      "script": {
        "inline": "return ['hosts': ctx.payload.aggregations.hosts.buckets.stream().map(b -> [b.key: b.values.value]).collect(Collectors.toList()) ]"
      }
    },

```

--Alex

---

<div class="post-metadata">

**Author:** ![Thanadol\_Thadasade](https://avatars.discourse-cdn.com/v4/letter/t/7ab992/32.png) [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)\
**Post date:** [July 13, 2017, 2:40am UTC](https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585/5 "2017-07-13T02:40:38Z")

</div>

Sorry for the trance question and a little grammar.  
I think you are amazing and thanks for help me. 😄 @spinscale

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2017, 2:40am UTC](https://discuss.elastic.co/t/how-to-show-memory-usage-is-at-values-percent/92585/6 "2017-08-10T02:40:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.