# Sending instance ID in watcher alert

**URL:** <https://discuss.elastic.co/t/sending-instance-id-in-watcher-alert/254903>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [November 10, 2020, 12:20pm UTC](https://discuss.elastic.co/t/sending-instance-id-in-watcher-alert/254903 "2020-11-10T12:20:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Agneb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/agneb/32/78746_2.png) [@Agneb](https://discuss.elastic.co/u/Agneb)\
**Post date:** [November 10, 2020, 12:20pm UTC](https://discuss.elastic.co/t/sending-instance-id-in-watcher-alert/254903/1 "2020-11-10T12:20:41Z")

</div>

Hi , i would like to create an alert using json , which sends the cloud.instance.id with the high CPU in the mail

{  
"trigger": {  
"schedule": {  
"interval": "1m"  
}  
},  
"input": {  
"search": {  
"request": {  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"filter": {  
"range": {  
"@timestamp": {  
"gte": "{{ctx.trigger.scheduled\_time}}||-5m",  
"lte": "{{ctx.trigger.scheduled\_time}}",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
}  
}  
}  
}  
},  
"aggs": {  
"bucketAgg": {  
"terms": {  
"field": "cloud.instance.id",  
"size": 5,  
"order": {  
"metricAgg": "desc"  
}  
},  
"aggs": {  
"metricAgg": {  
"max": {  
"field": "aws.ec2.cpu.total.pct"  
}  
}  
}  
}  
}  
},  
"indices": [  
"metricbeat-\*"  
]  
}  
}  
},  
"condition": {  
"script": {  
"source": "ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; for (int i = 0; i \< arr.length; i++) { if (arr[i]['metricAgg'].value \> params.threshold) { return true; } } return false;",  
"params": {  
"threshold": 1000  
}  
}  
},  
"transform": {  
"script": {  
"source": "HashMap result = new HashMap(); ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; ArrayList filteredHits = new ArrayList(); for (int i = 0; i \< arr.length; i++) { HashMap filteredHit = new HashMap(); filteredHit.key = arr[i].key; filteredHit.value = arr[i]['metricAgg'].value; if (filteredHit.value \> params.threshold) { filteredHits.add(filteredHit); } } result.results = filteredHits; return result;",  
"params": {  
"threshold": 80  
}  
}  
},  
"actions": {  
"email\_1": {  
"email": {  
"profile": "standard",  
"to": "[testtest@gmail.com](mailto:testtest@gmail.com)",  
"subject": "Watch [{{ctx.metadata.name}}] has exceeded the threshold",  
"body": {  
"text": "{{ctx.metadata.field}}"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2020, 12:20pm UTC](https://discuss.elastic.co/t/sending-instance-id-in-watcher-alert/254903/2 "2020-12-08T12:20:51Z")

</div>

Closed on December 8, 2020, 12:20pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.