# Need help for Energy Monitoring System Alerts

**URL:** <https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 14, 2017, 3:43pm UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415 "2017-06-14T15:43:38Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![jodhias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jodhias/32/19123_2.png) [@jodhias](https://discuss.elastic.co/u/jodhias)\
**Post date:** [June 14, 2017, 3:43pm UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/1 "2017-06-14T15:43:38Z")

</div>

Hello I'm a student and I really need your help to sort this out. So, I want to create a real time monitoring data for voltage consumption. The outcome will be: there will be an alert if the voltage value exceeds the 'UpperThreshold' or lower than the 'LowerThreshold' I still don't understand how to write the 'input' part properly. Can someone help me to do so?

**1. The response said like this:**  
"messages": [  
"failed to execute watch input"

**2. Here is my alerting code**  
{  
"trigger": {  
"schedule": {  
"interval": "5s"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"voltage-ab"  
],  
"types": [  
"VoltageAB"  
]  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.voltageValue": {  
"gt": 450  
}  
}  
},  
"actions": {  
"logging": {  
"logging": {  
"level": "info",  
"text": "its working!"  
}  
}  
}  
}

**3. And here is my index**

PUT /test-1  
{  
"mappings": {  
"Test1": {  
"properties": {  
"Value": {  
"type": "integer"  
},  
"date": {  
"type": "date",  
"format": "yyyy-MM-dd'T'HH:mm:ss.SSSZ"  
},  
"UpperThreshold": {  
"type": "integer"  
},  
"LowerThreshold": {  
"type": "integer"  
}  
}  
}  
}  
}

**4. This is the example input**  
POST /test-1/Test1  
{  
"Value": "500",  
"date": "2017-06-13T16:20:00.000Z",  
"UpperThreshold":"450",  
"LowerThreshold": "380"  
}

Thank you for your help

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 15, 2017, 3:36pm UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/2 "2017-06-15T15:36:53Z")

</div>

Hey,

please paste the output of the execute watch API here and not just a single line, so debugging will be possible. Thanks!

--Alex

---

<div class="post-metadata">

**Author:** ![jodhias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jodhias/32/19123_2.png) [@jodhias](https://discuss.elastic.co/u/jodhias)\
**Post date:** [June 15, 2017, 4:07pm UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/3 "2017-06-15T16:07:21Z")

</div>

{  
"watch\_id": "Voltage-AB-Watcher2",  
"state": "failed",  
"\_status": {  
"state": {  
"active": true,  
"timestamp": "2017-06-14T00:37:22.768Z"  
},  
"actions": {  
"logging": {  
"ack": {  
"timestamp": "2017-06-14T00:37:22.768Z",  
"state": "awaits\_successful\_execution"  
}  
}  
}  
},  
"trigger\_event": {  
"type": "schedule",  
"triggered\_time": "2017-06-15T16:06:46.961Z",  
"schedule": {  
"scheduled\_time": "2017-06-15T16:06:46.665Z"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"voltage-ab"  
],  
"types": [  
"VoltageAB"  
]  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.voltageValue": {  
"gt": 450  
}  
}  
},  
"metadata": {  
"name": "Voltage-AB-Watcher2"  
},  
"result": {  
"execution\_time": "2017-06-15T16:06:46.961Z",  
"execution\_duration": 1,  
"input": {  
"type": "search",  
"status": "failure",  
"reason": "NullPointerException[null]"  
},  
"actions": []  
},  
"messages": [  
"failed to execute watch input"  
]  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 16, 2017, 6:45am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/4 "2017-06-16T06:45:09Z")

</div>

Hey,

can you try changing your search input to also include a query like this

```auto
"indices" : [...],
"types" : [...],
"body" : {
  "query" : { "match_all": {}}
}

```

and report back if that works?

--Alex

---

<div class="post-metadata">

**Author:** ![jodhias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jodhias/32/19123_2.png) [@jodhias](https://discuss.elastic.co/u/jodhias)\
**Post date:** [June 24, 2017, 5:19am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/5 "2017-06-24T05:19:46Z")

</div>

Thank you Alex it works!

Can you help also how to locate the "Value" property in my index using the 'compare'? I want to get an alert if the latest Value is more than 450.

I guess this query: "ctx.payload.Value" : {"gt: 450"} is wrong, isnt it?

**This is the execution output:**

{  
"watch\_id": "Voltage-AB-Watcher2",  
"state": "execution\_not\_needed",  
"\_status": {  
"state": {  
"active": true,  
"timestamp": "2017-06-24T05:14:24.291Z"  
},  
"last\_checked": "2017-06-24T05:14:33.726Z",  
"actions": {  
"logging": {  
"ack": {  
"timestamp": "2017-06-24T05:14:24.291Z",  
"state": "awaits\_successful\_execution"  
}  
}  
}  
},  
"trigger\_event": {  
"type": "schedule",  
"triggered\_time": "2017-06-24T05:14:33.726Z",  
"schedule": {  
"scheduled\_time": "2017-06-24T05:14:33.251Z"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"test-1"  
],  
"types": [  
"Test1"  
],  
"body": {  
"query": {  
"match\_all": {}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.Value": {  
"gt": 400  
}  
}  
},  
"metadata": {  
"name": "Voltage-AB-Watcher2"  
},  
"result": {  
"execution\_time": "2017-06-24T05:14:33.726Z",  
"execution\_duration": 11,  
"input": {  
"type": "search",  
"status": "success",  
"payload": {  
"\_shards": {  
"total": 5,  
"failed": 0,  
"successful": 5  
},  
"hits": {  
"hits": [  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T14:30:00.000Z",  
"LowerThreshold": "380",  
"Value": "415",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiFsRyTbYjGVwV\_rPd",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T16:10:00.000Z",  
"LowerThreshold": "380",  
"Value": "420",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiE1t5TbYjGVwV\_rG-",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T16:50:00.000Z",  
"LowerThreshold": "380",  
"Value": "410",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiFD-\_TbYjGVwV\_rJL",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T15:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "425",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiFdJxTbYjGVwV\_rM0",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T06:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8d9PfS18ne-HaHbs",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T11:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "390",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8jUwfS18ne-HaHcu",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T19:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8t7YfS18ne-HaHev",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T23:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "410",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8wMmfS18ne-HaHfR",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-12T06:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys82zqfS18ne-HaHgx",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T20:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8uW9fS18ne-HaHew",  
"\_score": 1  
}  
],  
"total": 83,  
"max\_score": 1  
},  
"took": 9,  
"timed\_out": false  
},  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"test-1"  
],  
"types": [  
"Test1"  
],  
"body": {  
"query": {  
"match\_all": {}  
}  
}  
}  
}  
},  
**"condition": {**  
\*\* "type": "compare",\*\*  
\*\* "status": "success",\*\*  
\*\* "met": false,\*\*  
\*\* "compare": {\*\*  
\*\* "resolved\_values": {\*\*  
\*\* "ctx.payload.Value": null\*\*  
}  
}  
},  
"actions": []  
},  
"messages": []  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 24, 2017, 6:47am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/6 "2017-06-24T06:47:52Z")

</div>

hey,

if you are on Elasticsearch 5.x, always use a scripting condition like `return ctx.payload.Value > 450` as it's much simpler to use. It's as secure thanks to our relatively new painless scripting language.

--Alex

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 26, 2017, 6:50am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/7 "2017-06-26T06:50:00Z")

</div>

One more thing: When you are tring to access the `Value` of a found search hit, you need to specify the path like `ctx.payload.hits.hits[0]._source.Value` in painless or `ctx.payload.hits.hits.0.Value` in mustache.

Hope this helps!

--Alex

---

<div class="post-metadata">

**Author:** ![jodhias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jodhias/32/19123_2.png) [@jodhias](https://discuss.elastic.co/u/jodhias)\
**Post date:** [June 27, 2017, 8:01am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/8 "2017-06-27T08:01:57Z")

</div>

> [@spinscale](#):
>
> ctx.payload.hits.hits[0].\_source.Value

Thank you very much for your help! At first I thought that was the answer. It turns out, the response still indicates a 'null' like this: "ctx.payload.hits.hits[0].\_source.Value": null.

Why does the alert not triggered as expected?

**The response is like this (it is still the same) :**

{  
"watch\_id": "Voltage-AB-Watcher2",  
"state": "execution\_not\_needed",  
"\_status": {  
"state": {  
"active": true,  
"timestamp": "2017-06-27T07:27:38.068Z"  
},  
"last\_checked": "2017-06-27T07:27:58.149Z",  
"actions": {  
"logging": {  
"ack": {  
"timestamp": "2017-06-27T07:27:38.068Z",  
"state": "awaits\_successful\_execution"  
}  
}  
}  
},  
"trigger\_event": {  
"type": "schedule",  
"triggered\_time": "2017-06-27T07:27:58.149Z",  
"schedule": {  
"scheduled\_time": "2017-06-27T07:27:58.040Z"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"test-1"  
],  
"types": [  
"Test1"  
],  
"body": {  
"query": {  
"match\_all": {}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.hits[0].\_source.Value": {  
"gt": 400  
}  
}  
},  
"metadata": {  
"name": "Voltage-AB-Watcher2"  
},  
"result": {  
"execution\_time": "2017-06-27T07:27:58.149Z",  
"execution\_duration": 2,  
"input": {  
"type": "search",  
"status": "success",  
"payload": {  
"\_shards": {  
"total": 5,  
"failed": 0,  
"successful": 5  
},  
"hits": {  
"hits": [  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T14:30:00.000Z",  
"LowerThreshold": "380",  
"Value": "415",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiFsRyTbYjGVwV\_rPd",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T16:10:00.000Z",  
"LowerThreshold": "380",  
"Value": "420",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiE1t5TbYjGVwV\_rG-",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T16:50:00.000Z",  
"LowerThreshold": "380",  
"Value": "410",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiFD-\_TbYjGVwV\_rJL",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-13T15:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "425",  
"UpperThreshold": "450"  
},  
"\_id": "AVyiFdJxTbYjGVwV\_rM0",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T06:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8d9PfS18ne-HaHbs",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T11:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "390",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8jUwfS18ne-HaHcu",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T19:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8t7YfS18ne-HaHev",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T23:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "410",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8wMmfS18ne-HaHfR",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-12T06:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys82zqfS18ne-HaHgx",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-06-11T20:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AVys8uW9fS18ne-HaHew",  
"\_score": 1  
}  
],  
"total": 83,  
"max\_score": 1  
},  
"took": 1,  
"timed\_out": false  
},  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"test-1"  
],  
"types": [  
"Test1"  
],  
"body": {  
"query": {  
"match\_all": {}  
}  
}  
}  
}  
},  
"condition": {  
"type": "compare",  
"status": "success",  
"met": false,  
"compare": {  
"resolved\_values": {  
"ctx.payload.hits.hits[0].\_source.Value": null  
}  
}  
},  
"actions":   
},  
"messages":   
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 27, 2017, 8:33am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/9 "2017-06-27T08:33:57Z")

</div>

try to use mustache syntax in the compare condition, not painless syntax. Or use a scripted condition (which I personally would prefer)

---

<div class="post-metadata">

**Author:** ![jodhias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jodhias/32/19123_2.png) [@jodhias](https://discuss.elastic.co/u/jodhias)\
**Post date:** [July 17, 2017, 5:46am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/10 "2017-07-17T05:46:42Z")

</div>

Thank you for your replies! I dont know why it's still not working.... gotta work some more.

---

<div class="post-metadata">

**Author:** ![jodhias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jodhias/32/19123_2.png) [@jodhias](https://discuss.elastic.co/u/jodhias)\
**Post date:** [July 26, 2017, 3:31pm UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/11 "2017-07-26T15:31:13Z")

</div>

Hello, its me again. I did the mustache syntax, and the response is similar: the value is null. Can you elaborate a bit about what you said, in terms of the scripted condition? Really appreciate your help!

Response:  
{  
"watch\_id": "Alerting-Test",  
"state": "execution\_not\_needed",  
"\_status": {  
"state": {  
"active": true,  
"timestamp": "2017-07-26T15:27:35.497Z"  
},  
"last\_checked": "2017-07-26T15:27:38.625Z",  
"actions": {  
"logging": {  
"ack": {  
"timestamp": "2017-07-26T15:27:35.497Z",  
"state": "awaits\_successful\_execution"  
}  
}  
}  
},  
"trigger\_event": {  
"type": "schedule",  
"triggered\_time": "2017-07-26T15:27:38.625Z",  
"schedule": {  
"scheduled\_time": "2017-07-26T15:27:38.175Z"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"test-1"  
],  
"types": [  
"Test1"  
],  
"body": {  
"query": {  
"match\_all": {}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.hits.0.Value": {  
"gt": 450  
}  
}  
},  
"metadata": {  
"name": "Alerting-Test"  
},  
"result": {  
"execution\_time": "2017-07-26T15:27:38.625Z",  
"execution\_duration": 0,  
"input": {  
"type": "search",  
"status": "success",  
"payload": {  
"\_shards": {  
"total": 5,  
"failed": 0,  
"successful": 5  
},  
"hits": {  
"hits": [  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-22T12:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "350",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1P3lArbJ1tbnct4e",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-22T18:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "4100",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1Sq0ArbJ1tbnct4v",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-24T18:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "450",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1eLJArbJ1tbnct6G",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-23T00:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1VUzArbJ1tbnct5A",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-23T12:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "390",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1X4FArbJ1tbnct5R",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-23T18:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "390",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1YySArbJ1tbnct5T",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-26T00:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "4700",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1mflArbJ1tbnct67",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-26T06:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "390",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1oluArbJ1tbnct7M",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-21T12:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "400",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1IrZArbJ1tbnct3r",  
"\_score": 1  
},  
{  
"\_index": "test-1",  
"\_type": "Test1",  
"\_source": {  
"date": "2017-07-21T18:00:00.000Z",  
"LowerThreshold": "380",  
"Value": "440",  
"UpperThreshold": "450"  
},  
"\_id": "AV1-1LwzArbJ1tbnct38",  
"\_score": 1  
}  
],  
"total": 20,  
"max\_score": 1  
},  
"took": 1,  
"timed\_out": false  
},  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"test-1"  
],  
"types": [  
"Test1"  
],  
"body": {  
"query": {  
"match\_all": {}  
}  
}  
}  
}  
},  
"condition": {  
"type": "compare",  
"status": "success",  
"met": false,  
"compare": {  
"resolved\_values": {  
"ctx.payload.hits.hits.0.Value": null  
}  
}  
},  
"actions": []  
},  
"messages": []  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 28, 2017, 7:44am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/12 "2017-07-28T07:44:46Z")

</div>

Hey,

the path in your compare condition does not exist, you forgot to specify the `_source` field.

Yet, I still do not understand why you want to check values of a single document. Wouldnt it make more sense to find out the min/max value of the last 10 minute and use that one?

--Alex

---

<div class="post-metadata">

**Author:** ![jodhias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jodhias/32/19123_2.png) [@jodhias](https://discuss.elastic.co/u/jodhias)\
**Post date:** [July 28, 2017, 10:46am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/13 "2017-07-28T10:46:21Z")

</div>

1. yes, I tried to go with your advice here, "....ctx.payload.hits.hits[0].\_source.Value in painless or ctx.payload.hits.hits.0.Value in mustache." the results for both were the same.

2. Thanks for the insight, I understand more now. So here is my mission: I want to create an alert, say for the last 1 minute. I want to send an email if, at least there was a 'Value', which was outside of the range (stated by the 'Upper Threshold' and the 'Lower Threshold').

How do I correct the code?

All of my friends are unfamiliar with this kind of syntax, so your help is much appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2017, 10:46am UTC](https://discuss.elastic.co/t/need-help-for-energy-monitoring-system-alerts/89415/14 "2017-08-25T10:46:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.