Issue with Watcher for Volume of Container

I am trying to write an alert on Kibana wachers for volume of Container. But getting error. Below is my watcher which trying to execute. Please help.
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"metadata": {
"lower_bound": 0.5
},
"input": {
"search": {
"request": {
"indices": "mon-metrics-k8s-*",
"types": "doc",
"body": {
"query": {
"bool": {
"filter": [
{
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m"
}
}
},
{
"term": {
"type" : "number"
}
}
]
}
},
"aggs": {
"container": {
"terms": {
"field": "kubernetes.container.name",
"size": 100
},
"aggs": {
"total_in_bytes": {
"max": {
"field": "kubernetes.volume.fs.capacity.bytes"
}
},
"available_in_bytes": {
"max": {
"field": "kubernetes.volume.fs.used.bytes"
}
},
"free_ratio": {
"bucket_script": {
"buckets_path": {
"available_in_bytes": "available_in_bytes",
"total_in_bytes": "total_in_bytes"
},
"script": "params.available_in_bytes / params.total_in_bytes"
}
}
}
}
},
"size": 0
}
}
}
},
"throttle_period": "30m",
"condition": {
"script": {
"lang": "painless",
"source": "return ctx.payload.aggregations.container.buckets.stream().free_ratio.value > ctx.metadata.lower_bound);"
}
},
"actions": {
"log": {
"logging": {
"text": "Available space on Filesystem is below recommended ratio of {{ctx.metadata.lower_bound}} for following nodes: {{#ctx.payload._value}}For node {{node_name}}: {{available_in_gb}}gb of {{total_in_gb}}gb is available:{{/ctx.payload._value}}"
}
}
}
}

Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you :slight_smile:

What is the error you are receiving?

sure will make sure its formatted next time :slight_smile: . i am getting An internal server error occurred.
is my condition syntax correct ?
"condition": {
"script": {
"lang": "painless",
"source": "return ctx.payload.aggregations.container.buckets.stream().free_ratio.value > ctx.metadata.lower_bound);"
}
},

Hey,

please also provide the error message in addition to the script. In order to ease debugging I suggest you take a look at https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches

Also, you should take a look at the examples repo with alerting as it contains a couple of examples how to parse aggregation responses with painless.

--Alex

only internal server error , let me tell you want i am trying to do., i wanted to use fileds (metric beat)
kubernetes.volume.fs.capacity.bytes and kubernetes.volume.fs.used.bytes and calculate the ratio of FS usage and trigger alert if it more than .5

Hello,

There is probably a more detailed error than internal server error on the kibana server console, could you provide it?

Cheers!

i am using the watcher and using simulate the watch which is just showing this error

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.