thanks for reply.
I create some part of alert. But i dont create condition. i have a two search, first and second. i want to calculate first/second (percentage) < 50% .
Can you examine this condition?
Kind Regards,
Cem
{
"trigger": {
"schedule": {
"interval": "10m"
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"indices": [
"graylog*"
],
"body": {
"query": {
"bool": {
"must": [
{
"match": {
"ctxt_page_name": "Thank You"
}
},
{
"range": {
"timestamp": {
"from": "now-5m",
"to": "now"
}
}
}
]
}
}
}
}
}
}
},
{
"second": {
"search": {
"request": {
"indices": [
"graylog*"
],
"types": ,
"body": {
"query": {
"bool": {
"must": [
{
"match": {
"ctxt_page_name": "Payment"
}
},
{
"range": {
"timestamp": {
"from": "now-5m",
"to": "now"
}
}
}
]
}
}
}
}
}
}
}
]
}
},
"condition": {
"script": {
"source": "return ((ctx.payload.first.hits.total / ctx.payload.second.hits.total)*100) < 50",
"lang": "painless"
}
},
"actions": {
"email_users": {
"email": {
"profile": "standard",
"attachments": {
"copy_of_search_results.txt": {
"data": {
"format": "json"
}
}
},
"priority": "high",
"to": [
"cem.kuleyin@enuygun.com"
],
"subject": "ELASTIC STACK ALERT: Payment processing issues in Application!",
"body": {
"html": "--Alerts Notification Details--
This alert triggered because a total of {{ctx.payload.first.hits.total}} timeout logs and {{ctx.payload.second.hits.total}} payment approvals were found in the application within the last ten minutes!
ALERT NAME: {{ctx.watch_id}}
Link to Kibana Dashboard: https://your.secure.link.here"
}
}
}
},
"throttle_period": "1h"
}