# How to write the watcher condition & trigger rule

**URL:** <https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 23, 2016, 10:48am UTC](https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486 "2016-02-23T10:48:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lu1Lu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lu1lu/32/8024_2.png) [@Lu1Lu](https://discuss.elastic.co/u/Lu1Lu)\
**Post date:** [February 23, 2016, 10:48am UTC](https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486/1 "2016-02-23T10:48:47Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/2X/f/f20671f64000797260b725845bd8057494b9a651.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/4/40773008e49743aa543542844853c7606e5e8e76.png) hello！ this is the domain&netflow picture. now, i want to sent e-mail when "Sum of bytes" \>50,000.000(50MB) netflow .  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/6/64efdbf42ad5cafe78ff43b79b9c1bdd7a0accda.png)  
i copy the request to my configure .  
i read offical website long times ...  
"condition": {  
"script": "if (ctx.payload.aggregations.minutes.buckets.size() == 0) return false; def latest = ctx.payload.aggregations.minutes.buckets[-1]; def node = latest.nodes.buckets[0]; return node && node.cpu && node.cpu.value \>= 75;"  
},  
this example is same with my configure , i think it will match this bytes... ![](https://us1.discourse-cdn.com/elastic/original/2X/0/04fcc166758c168963c7b42ed8bda97266a87518.png) not dashbord "Sum of bytes",so i don't know how to compute "Sum of bytes " . ctx.payload.aggregations.bytes? ctx.payload.hits.total? or  
"condition" : {  
"compare" : { "ctx.payload.hits.total" : { "gt" : 50,000.000 }}  
},  
?  
and then, a day has gone by again. i trys any ways , but it doesn't still success. i'm going to crazy!!\>\_\< ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a8671742800f41a7badb9c4ba42d2c2f210ac705.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a6fd8550f9dcf0d56f040c0cf3e830c2fbb1926a.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/9/9f0dc2776f0c434b36bf1d676358937d57c161dc.png)  
i can't fixed error ....  
i edit my configure in the morning...  
{  
"trigger" : {  
"schedule" : { "interval" : "5s" }  
},  
"input" : {  
"search" : {  
"request" : {  
"indices" : ["access-2016.02.24"],  
"body" : {  
"query" : {  
"filtered": {  
"query": {  
"query\_string": {  
"query": "\*",  
"analyze\_wildcard": true  
}  
},  
"filter": {  
"bool": {  
"must": [  
{  
"range": {  
"@timestamp": {  
"gte": "now-5m",  
"lte": "now"  
}  
}  
}  
],  
"must\_not":   
}  
}  
}  
},  
"size": 0,  
"aggs": {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "5s",  
"time\_zone": "Asia/Shanghai"  
},  
"aggs": {  
"3": {  
"terms": {  
"field": "type",  
"size": 3,  
"order": {  
"1": "desc"  
}  
},  
"aggs": {  
"1": {  
"sum": {  
"field": "bytes"  
}  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"throttle\_period": "5s",  
"condition" : {  
"compare" : { "ctx.payload.aggregations.bytes.size()" : { "gt" : 50000000} }  
},  
"actions" : {  
"send\_email" : {  
"email" : {  
"to" : "kim@qq.com",  
"subject" : "netflow is too high",  
"body" : "netflow is too high "  
}  
}  
}  
}

@spinscale please help me !! foreign friends !

Thanks a lot!!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 25, 2016, 7:12pm UTC](https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486/2 "2016-02-25T19:12:46Z")

</div>

Hey there,

this was a lot of content 🙂

let's try to take a step back and analyze this before we go on.

First: How do you documents look like? Does each field have a document that contains a field `bytes` that needs to be summed up to find out the total? Can you provide an example document? Just to make sure we are talking about the same.

If my above assumption is correct, then using the `sum` aggregation makes sense. However your condition seems to be a bit off using the `size()` method. What exactly do you want to sum up? You already got the sum by type? If you need to the total sum, you could also just execute another aggregation. If you want to sum up manually, than `size()`will not help you as it is a groovy method trying to get the size of a list/map.

You should take a step back and try to debug things. First make sure, your result is as expected. Then, when you start writing your watch, you should make use of the [Execute Watch API](https://www.elastic.co/guide/en/watcher/current/api-rest.html#api-rest-execute-watch) to check, if your watch behaves as expected. This allows much faster debugging cycles.

Hope this helps.

--Alex

---

<div class="post-metadata">

**Author:** ![Lu1Lu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lu1lu/32/8024_2.png) [@Lu1Lu](https://discuss.elastic.co/u/Lu1Lu)\
**Post date:** [February 26, 2016, 12:50am UTC](https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486/3 "2016-02-26T00:50:56Z")

</div>

Thank you very much ,Alex. now i upload a picture for you

 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/1e0a2faa1b54abb65d2f293f6d318b4886467d8e.png)  
and then i edit my configure again... ![](https://us1.discourse-cdn.com/elastic/original/2X/f/fc340c9f26cfe30e45f8b195c837f23ec211893f.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/4/4def7ca5ab6c08da3a8b85b56a4abbc00e8e8346.png)  
i imitate here to write my configure ![](https://us1.discourse-cdn.com/elastic/original/2X/f/fdb2d557eefbac9a2cf8a9979775db6d74316919.png)  
but it is error again..  
please help me watch again. thanks !  
🙂

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 26, 2016, 6:42pm UTC](https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486/4 "2016-02-26T18:42:10Z")

</div>

Hey,

just posting screenshots makes it impossible to follow your problem based on a step-by-step base. Please provide examples, that makes it easy to not only follow, but to also recreate the example locally by copying it into a local installation of elasticsearch/watcher.

See the [help document](https://www.elastic.co/help) for further hints on how to provide examples, which can be easily read, understood and debugged by anyone in the forum.

Thanks a lot! Looking forward to help!

--Alex

---

<div class="post-metadata">

**Author:** ![Lu1Lu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lu1lu/32/8024_2.png) [@Lu1Lu](https://discuss.elastic.co/u/Lu1Lu)\
**Post date:** [February 27, 2016, 12:54am UTC](https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486/5 "2016-02-27T00:54:06Z")

</div>

yeah, i change the ways to alert logstash-\>mongodb-\>zabbix . my enginsh is so bad ,i can't express mean very well. but i'm so thank you .🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/how-to-write-the-watcher-condition-trigger-rule/42486/6 "2017-07-06T13:46:49Z")

</div>