# In my Elastic Watcher , Unable to get system.cpu.user.norm.pct value in percentage

**URL:** <https://discuss.elastic.co/t/in-my-elastic-watcher-unable-to-get-system-cpu-user-norm-pct-value-in-percentage/345109>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting, painless\
**Created:** [October 16, 2023, 1:26pm UTC](https://discuss.elastic.co/t/in-my-elastic-watcher-unable-to-get-system-cpu-user-norm-pct-value-in-percentage/345109 "2023-10-16T13:26:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sonirajil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sonirajil/32/99235_2.png) [@sonirajil](https://discuss.elastic.co/u/sonirajil)\
**Post date:** [October 16, 2023, 1:26pm UTC](https://discuss.elastic.co/t/in-my-elastic-watcher-unable-to-get-system-cpu-user-norm-pct-value-in-percentage/345109/1 "2023-10-16T13:26:46Z")

</div>

I am newbie to Painless , In my watch , I want to get system.cpu.user.norm.pct value in percentage not actual value (i.e. currently I am getting 0.90 for 90%) for which I need to multiply by 100 which I am unable to do successfully after lot and lot of trials I am seeking help here in this forum .  
I am getting quite a intuitive error which I am not able to solve .

```auto
        "caused_by": {
          "type": "class_cast_exception",
          "reason": "Cannot apply [*] operation to types [java.lang.String] and [java.lang.Integer]."
        }
      }
    },
    "actions": []
  },
  "messages": [
    "failed to execute watch transform"

```

and below is my full watch code :  
(I used for loop to create an individual mail for each instance of threshold breach as per requirement)

```auto
{
  "trigger": {
    "schedule": {
      "interval": "2m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "metricbeat-new*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "wildcard": {
                    "tags": {
                      "value": "test-qa-machine"
                    }
                }
                },
                {
                  "match": {
                    "event.dataset": "system.cpu"
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m",
                      "lte": "now"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "hostname": {
              "terms": {
                "field": "agent.hostname",
                "size": 1000
              },
              "aggs": {
                "avg_cpu": {
                  "avg": {
                    "field": "system.cpu.user.norm.pct"
                  }
                },
                "avg_cpu_bucket_filter": {
                  "bucket_selector": {
                    "buckets_path": {
                      "avgcpu": "avg_cpu"
                    },
                    "script": "params.avgcpu > 0.10"
                  }
                },
                "sort_by_hostname": {
                  "bucket_sort": {
                    "sort": [
                      {
                        "avg_cpu": {
                          "order": "desc"
                        }
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.hostname.buckets.0.doc_count": {
        "gt": 0
      }
    }
  },
 "transform": {
	"script": {
      "source": "return ['avg_cpu_percent': params.avgcpu * 100]",
      "lang": "painless",
      "params": {
        "avgcpu": "ctx.payload.aggregations.hostname.buckets[0].avg_cpu.value"
      }
    }
  },
  "actions": {
    "foreach_bucket": {
      "foreach": "ctx.payload.aggregations.hostname.buckets",
      "max_iterations": 10,
      "email": {
        "profile": "standard",
        "from": "elk@noreply.com",
        "to": [
          "rajil@abc.com"
        ],
        "subject": "Alert: High CPU usages for Host : {{ctx.payload.key}}",
        "body": {
          "text": """ CPU usage is greater than Threshold value (95%). Please investigate. 
                      Hostname: {{ctx.payload.key}} 
                      CPU Usage: {{ctx.payload.avg_cpu_percent}}% """
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![sonirajil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sonirajil/32/99235_2.png) [@sonirajil](https://discuss.elastic.co/u/sonirajil)\
**Post date:** [October 18, 2023, 1:16pm UTC](https://discuss.elastic.co/t/in-my-elastic-watcher-unable-to-get-system-cpu-user-norm-pct-value-in-percentage/345109/2 "2023-10-18T13:16:50Z")

</div>

Please help here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2023, 1:17pm UTC](https://discuss.elastic.co/t/in-my-elastic-watcher-unable-to-get-system-cpu-user-norm-pct-value-in-percentage/345109/3 "2023-11-15T13:17:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.