# Throttle\_period if request change

**URL:** https://discuss.elastic.co/t/throttle-period-if-request-change/226363
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [April 3, 2020, 8:06am UTC](https://discuss.elastic.co/t/throttle-period-if-request-change/226363 "2020-04-03T08:06:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Downer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/downer/32/65179_2.png) [@Downer](https://discuss.elastic.co/u/Downer)
#### Post date: [April 3, 2020, 8:06am UTC](https://discuss.elastic.co/t/throttle-period-if-request-change/226363/1 "2020-04-03T08:06:59Z")

</div>

Hello !  
I'm actually trying to monitor some url and return its status if error. I am ok with that and I added a `throttle_period` = 10m to prevent spam (my interval is 1m) but if a new url fall in this period I will get the information too late. So is it possible to have a throttle period but allow url change bypass it ?  
Here my watch:

```auto
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                      "lte": "{{ctx.trigger.scheduled_time}}",
                      "format": "strict_date_optional_time||epoch_millis"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "status_terms": {
              "terms": {
                "field": "http.response.status_code",
                "order": {
                  "_key": "asc"
                }
              },
              "aggs": {
                "test": {
                  "terms": {
                    "field": "url.full"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "ArrayList arr = ctx.payload.aggregations.status_terms.buckets; for (int i = 0; i < arr.length; i++) { if (arr[i].key > params.threshold) { return true; } } return false;",
      "lang": "painless",
      "params": {
        "threshold": 299
      }
    }
  },
  "actions": {
    "slack_1": {
      "throttle_period_in_millis": 600000,
      "foreach": "ctx.payload.results",
      "max_iterations": 100,
      "slack": {
        "message": {
          "text": "URL: {{ctx.payload.value}}\nSTATUS_CODE: {{ctx.payload.key}}"
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "HashMap result=new HashMap();ArrayList arr=ctx.payload.aggregations.status_terms.buckets;ArrayList filteredHits=new ArrayList();for(int i=0;i<arr.length;i++){if(arr[i].key>params.threshold){for(int j=0;j<arr[i].test.buckets.length;j++){HashMap filteredHit=new HashMap();filteredHit.key=arr[i].key;filteredHit.value=arr[i].test.buckets[j].key;filteredHits.add(filteredHit); } } } result.results=filteredHits;return result;",
      "lang": "painless",
      "params": {
        "threshold": 299
      }
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [April 3, 2020, 2:00pm UTC](https://discuss.elastic.co/t/throttle-period-if-request-change/226363/2 "2020-04-03T14:00:02Z")

</div>

Hey,

so a workaround (not the nicest one, but works) could be to query the watch history index for the last run of that watch (use `size:1` to only get the last response), and then use the contents of the search response of the previous run and compare them with the run of this one in the condition.

```auto
GET .watcher-history-*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "watch_id": "my_watch"
          }
        }
      ]
    }
  },
  "sort": [
    {
      "trigger_event.triggered_time": {
        "order": "desc"
      }
    }
  ]
}

```

hop that helps!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 1, 2020, 2:00pm UTC](https://discuss.elastic.co/t/throttle-period-if-request-change/226363/3 "2020-05-01T14:00:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.