# Trigger alert on field exceeding limit per host before it finds other host when its throttled

**URL:** <https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 19, 2018, 6:21pm UTC](https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210 "2018-10-19T18:21:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shiv94](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@shiv94](https://discuss.elastic.co/u/shiv94)\
**Post date:** [October 19, 2018, 6:21pm UTC](https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210/1 "2018-10-19T18:21:26Z")

</div>

Created a watcher alert when field exceeds limit, agg by host, throttled for 1 hour and scheduled the trigger for 5 min. The watcher is triggered, found one host which exceeds limit and its being throttled for 1 hour.The watcher again triggered, found other new host then it is also throttled. My question is even its throttled, if it finds a new host it should send an alert of previous found host before it reaches the throttled period.Is there any way to do that?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 22, 2018, 8:29am UTC](https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210/2 "2018-10-22T08:29:44Z")

</div>

Hey,

throttling always accounts for the whole watch. If it is not hundreds of thousands of hosts, it might be easier to have an alert per host instead of a grouping one.

--Alex

---

<div class="post-metadata">

**Author:** ![shiv94](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@shiv94](https://discuss.elastic.co/u/shiv94)\
**Post date:** [October 23, 2018, 2:27pm UTC](https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210/3 "2018-10-23T14:27:43Z")

</div>

Sends an alert whenever root exceeds limit per host and throttled for 1 hour  
{  
"trigger": {  
"schedule": {  
"interval": "5m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"metricbeat-\*"  
],  
"types": [],  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"must": [  
{  
"term": {  
"system.filesystem.mount\_point": {  
"value": "/"  
}  
}  
},  
{  
"range": {  
"system.filesystem.used.pct": {  
"gte": 0.8  
}  
}  
}  
]  
}  
},  
"aggs": {  
"host": {  
"terms": {  
"field": "beat.hostname"  
},  
"aggs": {  
"top\_hit": {  
"top\_hits": {  
"size": 1  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"always": {}  
},  
"actions": {  
"send\_email": {  
...  
...  
}  
},  
"throttle\_period\_in\_millis": 3600000  
}

If there is no host then alert contains empty value but it send an email. Do we have any option if its empty ( no host which exceeds limit ) don't send an email?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 23, 2018, 2:41pm UTC](https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210/4 "2018-10-23T14:41:04Z")

</div>

yes, use a condition that checks for the number of hits in the search response instead of being always `true`

---

<div class="post-metadata">

**Author:** ![shiv94](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@shiv94](https://discuss.elastic.co/u/shiv94)\
**Post date:** [October 23, 2018, 3:13pm UTC](https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210/5 "2018-10-23T15:13:24Z")

</div>

Thank you, it worked

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2018, 3:13pm UTC](https://discuss.elastic.co/t/trigger-alert-on-field-exceeding-limit-per-host-before-it-finds-other-host-when-its-throttled/153210/6 "2018-11-20T15:13:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.