# Show Critical(Red background), Heathy(Green backround) using Top hit

**URL:** <https://discuss.elastic.co/t/show-critical-red-background-heathy-green-backround-using-top-hit/354416>\
**Category:** Elasticsearch\
**Created:** [February 29, 2024, 7:56am UTC](https://discuss.elastic.co/t/show-critical-red-background-heathy-green-backround-using-top-hit/354416 "2024-02-29T07:56:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PRASHANT\_MEHTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prashant_mehta/32/101764_2.png) [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Post date:** [February 29, 2024, 7:56am UTC](https://discuss.elastic.co/t/show-critical-red-background-heathy-green-backround-using-top-hit/354416/1 "2024-02-29T07:56:51Z")

</div>

Hello All,  
I've a simple requirement and now it seems complex to achieve this in kibana and not sure how data can be handled here to show desired result.

There are multiple tomcat servers sending there status in tomcat-index with field usecaseStatus:"Healthy" or "Critical". The data is coming through perl business logic and Logstash config process this.  
Now I want for example any of the tomcat hosted on server 1, server2, server 3 becomes then overall usecaseStatus should be CRITICAL.  
Now issue is any of the Server will send healthy status then it shows wrong data that tomcat is healthy.

Intention is to show visual with HEALTHY or CRITICAL Status---But overall tomcat status should be critical if any of the host showing Critical

Consider 1 server showing Heathy and Other Critical then TOP HIT will show "Healthy status" at times- which is wrong. Any of the server tomcat is critical then overall status is critical , else Healthy.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d09445e04d48f635b881cbf75a549b2f5151ea7.png)

```auto
input {
   exec {
      command => '$APP/ms/scripts/monitoring_oore.ksh -c $RPCM_CONFIG/mis/globalconfiguration.properties -e yc_tomcat_monitoring.pl'
      schedule => "*/10 * * * * *"
   }
}

filter {
   split {}
   
   if [message] =~ "^\{.*\}[\s\S]*$" {
      json {
         source => "message"
         target => "parsed_json"
		 remove_field => "message"
      }
	  
      split {
         field => "[parsed_json][cis]"
         target => "tomcat"
         remove_field => ["parsed_json"]
      }
      
      
      if [tomcat][memory_status] == "Critical" or [tomcat][error_status] == "Critical" or [tomcat][request_status] == "Critical" or [tomcat][server_status] == "DOWN" {
         mutate {
            add_field => {
               "usecaseStatus" => "Critical"
               "usecaseCategory" => "Tomcat"
            }
         }
      } else {
         # Set default values if no critical conditions
         mutate {
            add_field => {
               "usecaseStatus" => "Healthy"
               "usecaseCategory" => "Tomcat"
            }
         }
      }

      mutate { remove_field => ["[event][original]" ] }
	  
   }
   else {
     drop { }
   }
}

```

Required: Critical Red else Healthy Green

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/246b2dab438ea078c29efa580bcfef2670e6ee8a.png)

---

<div class="post-metadata">

**Author:** ![PRASHANT\_MEHTA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prashant_mehta/32/101764_2.png) [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Post date:** [March 4, 2024, 11:31am UTC](https://discuss.elastic.co/t/show-critical-red-background-heathy-green-backround-using-top-hit/354416/2 "2024-03-04T11:31:30Z")

</div>

Can someone help here?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2024, 11:31am UTC](https://discuss.elastic.co/t/show-critical-red-background-heathy-green-backround-using-top-hit/354416/3 "2024-04-01T11:31:42Z")

</div>

Closed on April 1, 2024, 11:31am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.