# Issue with Watcher for Volume of Container **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [April 14, 2019, 11:05am UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776 "2019-04-14T11:05:40Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Sumanth\_Varma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumanth_varma/32/54918_2.png) [@Sumanth\_Varma](https://discuss.elastic.co/u/Sumanth_Varma)\ **Post date:** [April 14, 2019, 11:05am UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/1 "2019-04-14T11:05:40Z")
I am trying to write an alert on Kibana wachers for volume of Container. But getting error. Below is my watcher which trying to execute. Please help. { "trigger": { "schedule": { "interval": "5m" } }, "metadata": { "lower\_bound": 0.5 }, "input": { "search": { "request": { "indices": "mon-metrics-k8s-\*", "types": "doc", "body": { "query": { "bool": { "filter": [ { "range": { "timestamp": { "gte": "{{ctx.trigger.scheduled\_time}}||-5m" } } }, { "term": { "type" : "number" } } ] } }, "aggs": { "container": { "terms": { "field": "kubernetes.container.name", "size": 100 }, "aggs": { "total\_in\_bytes": { "max": { "field": "kubernetes.volume.fs.capacity.bytes" } }, "available\_in\_bytes": { "max": { "field": "kubernetes.volume.fs.used.bytes" } }, "free\_ratio": { "bucket\_script": { "buckets\_path": { "available\_in\_bytes": "available\_in\_bytes", "total\_in\_bytes": "total\_in\_bytes" }, "script": "params.available\_in\_bytes / params.total\_in\_bytes" } } } } }, "size": 0 } } } }, "throttle\_period": "30m", "condition": { "script": { "lang": "painless", "source": "return ctx.payload.aggregations.container.buckets.stream().free\_ratio.value \> ctx.metadata.lower\_bound);" } }, "actions": { "log": { "logging": { "text": "Available space on Filesystem is below recommended ratio of {{ctx.metadata.lower\_bound}} for following nodes: {{#ctx.payload.\_value}}For node {{node\_name}}: {{available\_in\_gb}}gb of {{total\_in\_gb}}gb is available:{{/ctx.payload.\_value}}" } } } } ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 14, 2019, 10:15pm UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/2 "2019-04-14T22:15:14Z")
Please format your code/logs/config using the `` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂 What is the error you are receiving? ---
**Author:** ![Sumanth\_Varma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumanth_varma/32/54918_2.png) [@Sumanth\_Varma](https://discuss.elastic.co/u/Sumanth_Varma)\ **Post date:** [April 15, 2019, 11:05am UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/3 "2019-04-15T11:05:15Z")
sure will make sure its formatted next time 🙂 . i am getting An internal server error occurred. is my condition syntax correct ? "condition": { "script": { "lang": "painless", "source": "return ctx.payload.aggregations.container.buckets.stream().free\_ratio.value \> ctx.metadata.lower\_bound);" } }, ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 15, 2019, 7:12pm UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/4 "2019-04-15T19:12:32Z")
Hey, please also provide the error message in addition to the script. In order to ease debugging I suggest you take a look at [https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches) Also, you should take a look at the [examples repo with alerting](https://github.com/elastic/examples/tree/master/Alerting) as it contains a couple of examples how to parse aggregation responses with painless. --Alex ---
**Author:** ![Sumanth\_Varma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumanth_varma/32/54918_2.png) [@Sumanth\_Varma](https://discuss.elastic.co/u/Sumanth_Varma)\ **Post date:** [April 17, 2019, 6:33am UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/5 "2019-04-17T06:33:35Z")
only internal server error , let me tell you want i am trying to do., i wanted to use fileds (metric beat) kubernetes.volume.fs.capacity.bytes and kubernetes.volume.fs.used.bytes and calculate the ratio of FS usage and trigger alert if it more than .5 ---
**Author:** ![sebastien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastien/32/36119_2.png) [@sebastien](https://discuss.elastic.co/u/sebastien)\ **Post date:** [April 17, 2019, 6:55am UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/6 "2019-04-17T06:55:22Z")
Hello, There is probably a more detailed error than `internal server error` on the kibana server console, could you provide it? Cheers! ---
**Author:** ![Sumanth\_Varma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumanth_varma/32/54918_2.png) [@Sumanth\_Varma](https://discuss.elastic.co/u/Sumanth_Varma)\ **Post date:** [April 17, 2019, 7:02am UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/7 "2019-04-17T07:02:56Z")
i am using the watcher and using simulate the watch which is just showing this error ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/f/3fe75e174645adb7633de59dbfcfbd53570968a8.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 15, 2019, 7:02am UTC](https://discuss.elastic.co/t/issue-with-watcher-for-volume-of-container/176776/8 "2019-05-15T07:02:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.