# Metricbeat memory watch - no conditions are met

**URL:** <https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [July 6, 2017, 7:20am UTC](https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030 "2017-07-06T07:20:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![manankalra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manankalra/32/21116_2.png) [@manankalra](https://discuss.elastic.co/u/manankalra)\
**Post date:** [July 6, 2017, 7:20am UTC](https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030/1 "2017-07-06T07:20:45Z")

</div>

Hey, I'm having trouble with setting alerts for my memory usage. I'm using Metricbeat which is stashing only the memory metrics to Elasticsearch.

This is the JSON for the watch that I've configured:

```
{
"trigger" : {
    "schedule" : {
    "interval": "10s"
    }
},
"input" : {
    "search" : {
    "request": {
        "search_type": "query_then_fetch",
        "indices" : ["metricbeat-2017.07.06"],
        "types": [],
        "body": {
            "query": {
                "match_all": {}
            }
        }
      }
    }
},
"condition": {
    "compare": {
        "ctx.payload.hits.hits._source.system.memory.actual.used.pct": {
            "gt": 0.5
        }
    }
},
"actions": {
    "logging": {
        "logging": {
            "level": "info",
                "text": "MEMORY USAGE ALERT!!! GREATER THAN 50%."
        }
    }
} 
}

```

I'm using match\_all{} because all my metricsets are of memory type. It shows that my memory usage is around 0.85 but still no actions are triggered and the condition.met is always false. Need help asap!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 6, 2017, 7:24am UTC](https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030/2 "2017-07-06T07:24:04Z")

</div>

please refrain from posting more than once. See the response on the other thread.

---

<div class="post-metadata">

**Author:** ![manankalra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manankalra/32/21116_2.png) [@manankalra](https://discuss.elastic.co/u/manankalra)\
**Post date:** [July 6, 2017, 5:44pm UTC](https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030/3 "2017-07-06T17:44:37Z")

</div>

Hey @spinscale, I'm still stuck. Can you please help?

---

<div class="post-metadata">

**Author:** ![manankalra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manankalra/32/21116_2.png) [@manankalra](https://discuss.elastic.co/u/manankalra)\
**Post date:** [July 7, 2017, 8:49am UTC](https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030/4 "2017-07-07T08:49:15Z")

</div>

I did revise my configuration again, same problems.

```
PUT _xpack/watcher/watch/temp2
{
  "input" : {
    "search" : {
      "request" : {
        "indices" : "metricbeat-2017.07.07",
        "body" : {
          "size" : 0,
          "query" : {
            "bool" : {
              "filter" : {
                "range" : {
                  "@timestamp": {
                    "from" : "now-2m",
                    "to" : "now"
                  }
                }
              }
            }
          },
          "aggs" : {
            "my_average" : {
              "avg": {
                "field": "_source.system.memory.actual.used.pct"
              }
            }
          }
        }
      }
    }
  },
  
  "trigger" : {
    "schedule" : {
      "interval" : "10s"
    }
  }, 
  
  "condition" : {
    "compare" : {
      "ctx.payload.hits.hits.0._source.system.memory.actual.used.pct" : {
        "gte" : 0.50
      }
    }
  },
  
  "actions" : {
    "logging" : {
      "logging" : {
        "text" : "CPU USAGE ALERT!!! GREATER THAN 50%."
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 7, 2017, 12:09pm UTC](https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030/5 "2017-07-07T12:09:39Z")

</div>

Hey,

first, please be aware that this is a forum, so there is no obligation to keep to any kind of SLA when providing answers, everything here is voluntary.

Second, please take your time and make sure you understood how watcher works, before writing complex watches.

You have changed you query to not contain any hits, but only contain aggregation results. However your condition still expects hits to be returned, even though you would need to check for thresholds now in the aggregation data.

It may be hard to debug watches, but you should really take the time and read the long blog post to understand how watches can be debugged, so that writing and maintaining watches is less tedious. The blog post is available at [https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches)

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2017, 12:09pm UTC](https://discuss.elastic.co/t/metricbeat-memory-watch-no-conditions-are-met/92030/6 "2017-08-04T12:09:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.