# One query that monitors multiple results. - Need help
**URL:** https://discuss.elastic.co/t/one-query-that-monitors-multiple-results-need-help/77377
**Category:** Elasticsearch
**Created:** [March 4, 2017, 6:05am UTC](https://discuss.elastic.co/t/one-query-that-monitors-multiple-results-need-help/77377 "2017-03-04T06:05:22Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@t.Farestad](https://discuss.elastic.co/u/t.Farestad)
#### Post date: [March 4, 2017, 6:05am UTC](https://discuss.elastic.co/t/one-query-that-monitors-multiple-results-need-help/77377/1 "2017-03-04T06:05:22Z")
Essentially, I'd like to write one query/watch that can essentially do a for each on the results.
We have multiple services (each defined within the key) and we'd like to write one query that can compare the success/failure rate of each individual key. My results are below, but each key will have a success and error bucket (if error exists).
How can I write one query that will tell me the individual service that has a high error rate from this query, vs writing a multitude of queries, one for each individual services?
Here is a shortened version of my results:
"aggregations": {
"services": {
"doc\_count\_error\_upper\_bound": 1190,
"sum\_other\_doc\_count": 480216,
"buckets": [
{
"key": "searchincidentmgmtdata",
"doc\_count": 93852,
"histo": {
"buckets": [
{
"key\_as\_string": "2017-03-03T04:00:00.000Z",
"key": 1488513600000,
"doc\_count": 1226,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 1226
}
]
}
},
{
"key\_as\_string": "2017-03-03T08:00:00.000Z",
"key": 1488528000000,
"doc\_count": 297,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 297
}
]
}
},
{
"key\_as\_string": "2017-03-03T12:00:00.000Z",
"key": 1488542400000,
"doc\_count": 12673,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 12673
}
]
}
},
{
"key\_as\_string": "2017-03-03T16:00:00.000Z",
"key": 1488556800000,
"doc\_count": 30519,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 30519
}
]
}
},
{
"key\_as\_string": "2017-03-03T20:00:00.000Z",
"key": 1488571200000,
"doc\_count": 33711,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 33711
}
]
}
},
{
"key\_as\_string": "2017-03-04T00:00:00.000Z",
"key": 1488585600000,
"doc\_count": 14764,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 14764
}
]
}
},
{
"key\_as\_string": "2017-03-04T04:00:00.000Z",
"key": 1488600000000,
"doc\_count": 662,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 662
}
]
}
}
]
}
},
{
"key": "getclientchannel"
"doc\_count": 40823,
"histo": {
"buckets": [
{
"key\_as\_string": "2017-03-03T04:00:00.000Z",
"key": 1488513600000,
"doc\_count": 4016,
"status": {
"doc\_count\_error\_upper\_bound": 0,
"sum\_other\_doc\_count": 0,
"buckets": [
{
"key": "success",
"doc\_count": 3896
},
{
"key": "error",
"doc\_count": 120
}
]
}
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [March 4, 2017, 8:21am UTC](https://discuss.elastic.co/t/one-query-that-monitors-multiple-results-need-help/77377/2 "2017-03-04T08:21:12Z")
How many services do you have? What action will you take based on the error rates you find? Are you only interested in services with errors?
---
### Author:  [@t.Farestad](https://discuss.elastic.co/u/t.Farestad)
#### Post date: [March 6, 2017, 4:29pm UTC](https://discuss.elastic.co/t/one-query-that-monitors-multiple-results-need-help/77377/3 "2017-03-06T16:29:58Z")
Here is the query to get the # of success/errors for each service in a particular bucket.
{
"size": 0,
"query": {
"range": {
"@timestamp": {
"gte": "now-1d"
}
}
},
"aggs": {
"services": {
"terms": {
"field": "LogEntry.ProcessName",
"min\_doc\_count": 10
},
"aggs": {
"histo": {
"date\_histogram": {
"field": "@timestamp",
"interval": "4h"
},
"aggs": {
"status": {
"terms": {
"field": "LogEntry.ProcessResult"
}
}
}
}
}
}
}
}
What we need is essentially the success/total for each bucket, if it drops below say 99.9, we want to open a ticket in ServiceNow via Evanios.
---
### Author:  [@t.Farestad](https://discuss.elastic.co/u/t.Farestad)
#### Post date: [March 6, 2017, 7:51pm UTC](https://discuss.elastic.co/t/one-query-that-monitors-multiple-results-need-help/77377/4 "2017-03-06T19:51:38Z")
Just figured it out after playing around with it again this morning:
GET /applog-\*/\_search
{
"size": 0,
"query": {
"range": {
"@timestamp": {
"gte": "now-1d"
}
}
},
"aggregations": {
"services": {
"terms": {
"field": "LogEntry.ProcessName",
"min\_doc\_count": 10
},
"aggs": {
"histo": {
"date\_histogram": {
"field": "@timestamp",
"interval": "4h"
},
"aggs": {
"success\_filter": {
"filter": {
"term": {
"LogEntry.ProcessResult": "success"
}
}
},
"success\_rate" : {
"bucket\_script": {
"buckets\_path": {
"total\_successes": "success\_filter\>\_count",
"total\_count": "\_count"
},
"script": "total\_successes / total\_count \* 100"
}
}
}
}
}
}
}
}
This gives me my expected results, with a field called "Success\_rate" within each bucket that I can watch off of.
Example result:
"histo": {
"buckets": [
{
"key\_as\_string": "2017-03-05T16:00:00.000Z",
"key": 1488729600000,
"doc\_count": 650,
"success\_filter": {
"doc\_count": 650
},
"success\_rate": {
"value": 100
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2017, 7:52pm UTC](https://discuss.elastic.co/t/one-query-that-monitors-multiple-results-need-help/77377/5 "2017-04-03T19:52:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.