Need help getting the Watcher "condition" to trigger from the JVM Heap Pct usage

Elastic Stack Elasticsearch
1

I am not sure what I am doing wrong in getting the watcher to trigger. Each of the current three nodes has the JVM Heap Usage Pct over 25% (attached screenshot). The condition in the watcher is purposely set at > 5% to get a trigger. The aggregation basically return doc_count > 0 when the "node_stats.jvm.mem.heap_used_percent" is "gt" 5. Here is the gists for the Watcher, GET & RESPONSE:

Watcher:

GET & RESPONSE from aggregations:

Logs Result for condition met is false,
result.condition.met false
result.condition.status success

JVM Heap Percent Usage:
Screen Shot 2019-12-16 at 1.06.50 PM

Thanks in Advance.

2

can you share the output of the execute watch API or the watcher history? This will show the data that was retrieved and was executed against the watch condition - which should help to pinpoint the problem.

Thanks!

3

This is the latest from watcher history,

4

Hey,

so this one states

"condition": {
"type": "script",
"status": "success",
"met": false
}

which means that the condition was not met. Looking at the response data this makes sense

"aggregations": {
"minutes": {
"buckets":
}
}

The first aggregation buckets are empty.

5

Thanks for pointing out the buckets was empty. Took out the field "types": [ "node_stats" ] and now the condition is met the bucket contain the three nodes heap jvm used pct. Not sure why taking out the field "types" would caused the condition to be met.

6

gflad you got it up and running. happy to take a further look with the help of the execute api if you want

7

Please have a look,

9

are you using a newer ES version like 7.x? Then the document types have started to vanish, thus you don't see anything when the type query remains.

10

I'm using ES 7.4. Are you saying is not necessary to have 'types' in 7.x? Thanks.

11

I'm trying out the 'array_compare' in condition to trigger only node that met the condition and was to set the the 'path' for the array. I was not able to find from ES 7.x documentation how to set the path for array, https://www.elastic.co/guide/en/elasticsearch/reference/7.5/condition-array-compare.html

Since there are buckets nested within another buckets, what is the path syntax to get to the field in the nested buckets?

12

If you have to check for two nested buckets arrays, then array compare will not work and you have to use the script condition.

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.