Issue with Watcher for Volume of Container

[Sumanth_Varma]

I am trying to write an alert on Kibana wachers for volume of Container. But getting error. Below is my watcher which trying to execute. Please help.
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"metadata": {
"lower_bound": 0.5
},
"input": {
"search": {
"request": {
"indices": "mon-metrics-k8s-*",
"types": "doc",
"body": {
"query": {
"bool": {
"filter": [
{
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m"
}
}
},
{
"term": {
"type" : "number"
}
}
]
}
},
"aggs": {
"container": {
"terms": {
"field": "kubernetes.container.name",
"size": 100
},
"aggs": {
"total_in_bytes": {
"max": {
"field": "kubernetes.volume.fs.capacity.bytes"
}
},
"available_in_bytes": {
"max": {
"field": "kubernetes.volume.fs.used.bytes"
}
},
"free_ratio": {
"bucket_script": {
"buckets_path": {
"available_in_bytes": "available_in_bytes",
"total_in_bytes": "total_in_bytes"
},
"script": "params.available_in_bytes / params.total_in_bytes"
}
}
}
}
},
"size": 0
}
}
}
},
"throttle_period": "30m",
"condition": {
"script": {
"lang": "painless",
"source": "return ctx.payload.aggregations.container.buckets.stream().free_ratio.value > ctx.metadata.lower_bound);"
}
},
"actions": {
"log": {
"logging": {
"text": "Available space on Filesystem is below recommended ratio of {{ctx.metadata.lower_bound}} for following nodes: {{#ctx.payload._value}}For node {{node_name}}: {{available_in_gb}}gb of {{total_in_gb}}gb is available:{{/ctx.payload._value}}"
}
}
}
}

[warkolm (Mark Walkom)]

Please format your code/logs/config using the </> button, or markdown style back ticks. It helps to make things easy to read which helps us help you

What is the error you are receiving?

[Sumanth_Varma]

sure will make sure its formatted next time . i am getting An internal server error occurred.
is my condition syntax correct ?
"condition": {
"script": {
"lang": "painless",
"source": "return ctx.payload.aggregations.container.buckets.stream().free_ratio.value > ctx.metadata.lower_bound);"
}
},

[spinscale (Alexander Reelsen)]

Hey,

please also provide the error message in addition to the script. In order to ease debugging I suggest you take a look at https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches

Also, you should take a look at the examples repo with alerting as it contains a couple of examples how to parse aggregation responses with painless.

--Alex

[Sumanth_Varma]

only internal server error , let me tell you want i am trying to do., i wanted to use fileds (metric beat)
kubernetes.volume.fs.capacity.bytes and kubernetes.volume.fs.used.bytes and calculate the ratio of FS usage and trigger alert if it more than .5

[sebastien]

Hello,

There is probably a more detailed error than internal server error on the kibana server console, could you provide it?

Cheers!

[Sumanth_Varma]

i am using the watcher and using simulate the watch which is just showing this error