Hi,
I have an ELK pipeline to read logs and capture metrics, now i am unable to figure out the following statement or query the datapoints for the ELK watcher,
metric_x >= 500 for 5 datapoints within 5 minutes with statistic "maximum", what should be my query in watcher input and condition, currently i have the following attached condition -
@spinscale @felixbarny
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"prod-dash-*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-3m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
},
"aggs": {
"metricAgg": {
"sum": {
"field": "metric_xxxx"
}
}
}
}
}
}
},
"condition": {
"always": {}
},
"actions": {
"pagerduty": {
"throttle_period_in_millis": 1800000,
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.metricAgg.value > params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 4
}
}
},
"webhook": {
"scheme": "https",
"host": "events.pagerduty.com",
"port": 443,
"method": "post",
"path": "/generic/2010-04-15/create_event.json",
"params": {},
"headers": {
"Content-type": "application/json"
},
"body": "{\"service_key\": \"xxxx\",\"incident_key\": \"xxx\",\"event_type\": \"trigger\",\"description\": \"xxxx for xxx>4 in last 3 minutes\"}"
}
},
"pagerduty-resolve": {
"condition": {
"script": {
"source": "if (ctx.payload.aggregations.metricAgg.value < params.threshold) { return true; } return false;",
"lang": "painless",
"params": {
"threshold": 4
}
}
},
"webhook": {
"scheme": "https",
"host": "events.pagerduty.com",
"port": 443,
"method": "post",
"path": "/generic/2010-04-15/create_event.json",
"params": {},
"headers": {
"Content-type": "application/json"
},
"body": "{\"service_key\": \"xxxxx\",\"incident_key\": \"xx\",\"event_type\": \"resolve\",\"description\": \"Issue resolved xxxxx>4 in last 3 minutes\"}"
}
}
}
}