# Metricbeat "system.cpu.user.pct" alert?

**URL:** <https://discuss.elastic.co/t/metricbeat-system-cpu-user-pct-alert/92081>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [July 6, 2017, 10:48am UTC](https://discuss.elastic.co/t/metricbeat-system-cpu-user-pct-alert/92081 "2017-07-06T10:48:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fdsfsddsf\_Sdfsd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fdsfsddsf_sdfsd/32/18527_2.png) [@Fdsfsddsf\_Sdfsd](https://discuss.elastic.co/u/Fdsfsddsf_Sdfsd)\
**Post date:** [July 6, 2017, 10:48am UTC](https://discuss.elastic.co/t/metricbeat-system-cpu-user-pct-alert/92081/1 "2017-07-06T10:48:25Z")

</div>

```auto
Send Request = {
  "error": {
    "root_cause": [
      {
        "type": "general_script_exception",
        "reason": "failed to compile script [ScriptException[compile error]; nested: IllegalArgumentException[unexpected token ['{'] was expecting one of [{<EOF>, ';'}].];]"
      }
    ],
    "type": "general_script_exception",
    "reason": "failed to compile script [ScriptException[compile error]; nested: IllegalArgumentException[unexpected token ['{'] was expecting one of [{<EOF>, ';'}].];]"
  },
  "status": 500
}

```

Code:

```auto
PUT _xpack/watcher/watch/cpu_usage
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "metricbeat-*"
        ],
        "types" : [
          "metricsets"
        ],
        "body": {
          "size" : 0,
          "query": {
            "filtered": {
              "filter": {
                "range": {
                  "timestamp": {
                    "gte": "now-2m",
                    "lte": "now"
                  }
                }
              }
            }
          },
          "aggs": {
            "minutes": {
              "date_histogram": {
                "field": "@timestamp",
                "interval": "minute"
              },
              "aggs": {
                "nodes": {
                  "terms": {
                    "field": "beat.name",
                    "size": 10,
                    "order": {
                      "cpu": "desc"
                    }
                  },
                  "aggs": {
                    "cpu": {
                      "avg": {
                        "field": "system.cpu.user.pct"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "throttle_period": "30m", 
  "condition": {
    "script": "if (ctx.payload.aggregations.minutes.buckets.size() == 0) return false; def latest = ctx.payload.aggregations.minutes.buckets[-1]; def node = latest.nodes.buckets[0]; return node && node.cpu && node.cpu.value >= 10;"
  },
  "actions": {
    "send_email": { 
      "transform": {
        "script": "def latest = ctx.payload.aggregations.minutes.buckets[-1]; return latest.nodes.buckets.findAll { return it.cpu && it.cpu.value >= 10 };"
      },
      "email": {
         "to": "<username>@<domainname>",
        "subject": "Watcher Notification - HIGH CPU USAGE",
        "body": "Nodes with HIGH CPU Usage (above 10%):\n\n{{#ctx.payload._value}}\"{{key}}\" - CPU Usage is at {{cpu.value}}%\n{{/ctx.payload._value}}"
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2017, 10:48am UTC](https://discuss.elastic.co/t/metricbeat-system-cpu-user-pct-alert/92081/2 "2017-08-03T10:48:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.