Using Aggregates in Watch JSON to eliminate duplicate entries in alert

[johncam]

I'm attempting to put together a JSON that will present the maximum value recorded against any host over a designated period.

However, although my syntax below parses without error, I am failing to see any entries at all being posted to email, even though I can clearly see the correct values being exposed when running a simulation.

I'd be grateful if anybody could point out the error of my ways below:

{
"trigger": {
"schedule": {
"interval": "60m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"metricbeat-*"
],
"types": ,
"body": {
"aggs": {
"host": {
"terms": {
"field": "host",
"order": {
"disk_usage": "asc"
}
},
"aggs": {
"disk_usage": {
"max": {
"field": "windows.perfmon.LogicalDiskF.FreeSpace.pct"
}
}
}
}
},
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-{{ctx.metadata.window_period}}"
}
}
},
{
"range": {
"windows.perfmon.LogicalDiskF.FreeSpace.pct": {
"gt": 0,
"lte": "{{ctx.metadata.threshold}}"
}
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"email_me": {
"throttle_period_in_millis": 120000,
"email": {
"profile": "standard",
"attachments": {
"XXX_F_DRIVE_FREE_SPACE.json": {
"data": {
"format": "json"
}
}
},
"from": "123456@xxx.co.uk",
"to": [
"xxx.xx.xx@xxxxxxxxx.com"
],
"subject": " ELASTIC ALERT: Free Disk Space on F",
"body": {
"html": "The following hosts have less than {{ctx.metadata.threshold}}% free disk space on the F: drive:
{{#ctx.payload.hosts}}
{{disk_usage}}%:{{/ctx.payload.hosts}}"
}
}
}
},
"metadata": {
"window_period": "60m",
"threshold": 5
}
}

[Brandon_Kobel]

Hey @johncam, have you tried switching your action to a log-action, similar to the following, and and seeing if your message shows up in your Elasticsearch logs? This will help us determine if it's an issue with the watch definition itself, or whether SMTP isn't configured properly for Elasticsearch:

"actions": {
    "my-logging-action": {
      "logging": {
        "text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10."
      }
    }
  }