# Kibana - sentinl calculating alert

**URL:** <https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459>\
**Category:** Kibana\
**Created:** [November 13, 2018, 11:24am UTC](https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459 "2018-11-13T11:24:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![cemkuleyin](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@cemkuleyin](https://discuss.elastic.co/u/cemkuleyin)\
**Post date:** [November 13, 2018, 11:24am UTC](https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459/1 "2018-11-13T11:24:30Z")

</div>

Hi everyone,

I want to create alert on sentinl. But i stucked.

In our case, we have two field, i want to calculate field1 / field2 and sent notification via email.

But i cannot do that. Our codes are,

**input =\>**

{  
"search": {  
"request": {  
"index": [  
"graylog\*"  
],  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"filter": [  
{  
"range": {  
"timestamp": {  
"from": "now-5m",  
"to": "now"  
}  
}  
},  
{  
"term": {  
"ctxt\_status": "COMPLETE\_SUCCESS"  
}  
}  
]  
}  
},  
"aggs": {  
"1": {  
"terms": {  
"field": "ctxt\_request\_id"  
}  
},  
"2": {  
"terms": {  
"field": "ctxt\_request\_id"  
}  
}  
}  
}  
}  
}  
}

**condition**

{  
"script": {  
"source": "return (ctx.payload.1.hits.total / ctx.payload.2.hits.total) == 0"  
}  
}

**actions email body**

{{ctx.payload.aggregations.1.buckets.1.doc\_count}} /{{ctx.payload.aggregations.1.buckets.2.doc\_count}}

Please help me asap.

Thanks.

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [November 13, 2018, 6:03pm UTC](https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459/2 "2018-11-13T18:03:14Z")

</div>

This is more of a watcher question. Pinging @spinscale for more insight.

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 13, 2018, 7:46pm UTC](https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459/3 "2018-11-13T19:46:41Z")

</div>

Sentinl is third party plugin, so you may have a better chance of getting an answer if you contact the creators.

---

<div class="post-metadata">

**Author:** ![cemkuleyin](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@cemkuleyin](https://discuss.elastic.co/u/cemkuleyin)\
**Post date:** [November 14, 2018, 6:29am UTC](https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459/4 "2018-11-14T06:29:14Z")

</div>

Thanks for answers. But i stucked.

@spinscale,

can you help me?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 26, 2018, 3:41pm UTC](https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459/5 "2018-11-26T15:41:18Z")

</div>

I agree with @Christian_Dahlqvist here to contact the creators in their github repository and ask how this works, as the mentioned extension is not developed/supported by Elastic.

Hope this helps and good luck!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2018, 3:41pm UTC](https://discuss.elastic.co/t/kibana-sentinl-calculating-alert/156459/6 "2018-12-24T15:41:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.