I am trying to write an alert on Kibana wachers for volume of Container. But getting error. Below is my watcher which trying to execute. Please help.
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"metadata": {
"lower_bound": 0.5
},
"input": {
"search": {
"request": {
"indices": "mon-metrics-k8s-*",
"types": "doc",
"body": {
"query": {
"bool": {
"filter": [
{
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m"
}
}
},
{
"term": {
"type" : "number"
}
}
]
}
},
"aggs": {
"container": {
"terms": {
"field": "kubernetes.container.name",
"size": 100
},
"aggs": {
"total_in_bytes": {
"max": {
"field": "kubernetes.volume.fs.capacity.bytes"
}
},
"available_in_bytes": {
"max": {
"field": "kubernetes.volume.fs.used.bytes"
}
},
"free_ratio": {
"bucket_script": {
"buckets_path": {
"available_in_bytes": "available_in_bytes",
"total_in_bytes": "total_in_bytes"
},
"script": "params.available_in_bytes / params.total_in_bytes"
}
}
}
}
},
"size": 0
}
}
}
},
"throttle_period": "30m",
"condition": {
"script": {
"lang": "painless",
"source": "return ctx.payload.aggregations.container.buckets.stream().free_ratio.value > ctx.metadata.lower_bound);"
}
},
"actions": {
"log": {
"logging": {
"text": "Available space on Filesystem is below recommended ratio of {{ctx.metadata.lower_bound}} for following nodes: {{#ctx.payload._value}}For node {{node_name}}: {{available_in_gb}}gb of {{total_in_gb}}gb is available:{{/ctx.payload._value}}"
}
}
}
}
Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you 
What is the error you are receiving?
sure will make sure its formatted next time . i am getting An internal server error occurred.
is my condition syntax correct ?
"condition": {
"script": {
"lang": "painless",
"source": "return ctx.payload.aggregations.container.buckets.stream().free_ratio.value > ctx.metadata.lower_bound);"
}
},
Hey,
please also provide the error message in addition to the script. In order to ease debugging I suggest you take a look at https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches
Also, you should take a look at the examples repo with alerting as it contains a couple of examples how to parse aggregation responses with painless.
--Alex
only internal server error , let me tell you want i am trying to do., i wanted to use fileds (metric beat)
kubernetes.volume.fs.capacity.bytes and kubernetes.volume.fs.used.bytes and calculate the ratio of FS usage and trigger alert if it more than .5
Hello,
There is probably a more detailed error than internal server error on the kibana server console, could you provide it?
Cheers!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.