# Want to log marvel watch (for high memory usage) results to an index

**URL:** <https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 2, 2016, 7:49pm UTC](https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047 "2016-08-02T19:49:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![casieowen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/casieowen/32/8734_2.png) [@casieowen](https://discuss.elastic.co/u/casieowen)\
**Post date:** [August 2, 2016, 7:49pm UTC](https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047/1 "2016-08-02T19:49:29Z")

</div>

Hi,

I have watches pointing at our main (non marvel) cluster and logging results was watch\_records in an index we created for this purpose. Eventually we're going to hook this up to a webhook, but for now just want a log. Here's the watch definition:

PUT \_watcher/watch/cluster\_health\_watch\_clusterisredtowatcherlog  
{  
"trigger" : {  
"schedule" : { "interval" : "60s" }  
},  
"input" : {  
"http" : {  
"request" : {  
"host" : "localhost",  
"port" : 9200,  
"path" : "/\_cluster/health"  
}  
}  
},  
"throttle\_period": "30m",  
"condition" : {  
"compare" : {  
"ctx.payload.status" : { "eq" : "red" }  
}  
},  
"actions" : {  
"index\_payload" : {  
"index" : {  
"index" : "watch\_record\_log",  
"doc\_type" : "watch\_record"

}  
}  
}  
}

I'd like to do the same thing for high memory utilization. Using [https://www.elastic.co/guide/en/watcher/2.3/watching-marvel-data.html](https://www.elastic.co/guide/en/watcher/2.3/watching-marvel-data.html) as a guide, I tried:

PUT \_watcher/watch/mem\_watch  
{  
"trigger": {  
"schedule": {  
"interval": "1m"  
}  
},  
"input": {  
"search": {  
"request": {  
"indices": [  
".marvel\*"  
],  
"types" : [  
"node\_stats"  
],  
"body": {  
"size" : 0,  
"query": {  
"bool": {  
"filter": {  
"range": {  
"timestamp": {  
"gte": "now-2m",  
"lte": "now"  
}  
}  
}  
}  
},  
"aggs": {  
"minutes": {  
"date\_histogram": {  
"field": "timestamp",  
"interval": "minute"  
},  
"aggs": {  
"nodes": {  
"terms": {  
"field": "source\_node.name",  
"size": 10,  
"order": {  
"memory": "desc"  
}  
},  
"aggs": {  
"memory": {  
"avg": {  
"field": "node\_stats.jvm.mem.heap\_used\_percent"  
}  
}  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"throttle\_period": "30m",  
"condition": {  
"script": "if (ctx.payload.aggregations.minutes.buckets.size() == 0) return false; def latest = ctx.payload.aggregations.minutes.buckets[-1]; def node = latest.nodes.buckets[0]; return node && node.memory && node.memory.value \>= 75;"  
},  
"actions" : {  
"index\_payload" : {  
"index" : {  
"index" : "watch\_record\_log",  
"doc\_type" : "watch\_record"  
}  
}  
}  
}

But, I'm getting:

"messages": [  
"failed to execute watch input"  
],  
"result": {  
"execution\_time": "2016-08-02T19:25:17.111Z",  
"execution\_duration": 157,  
"input": {  
"type": "search",  
"status": "failure",  
"reason": "SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[nZOwlZoDSMW--YR\_ZlqePQ][.marvel-2016.06.01][0]: RemoteTransportException[[marvelnode][inet[/xx.x.x.xx:xxxx]][indices:data/read/search[phase/query]]]; nested: SearchParseException[[.marvel-2016.06.01][0]: from[-1],size[0]: Parse Failure [Failed to parse source [{"size":0,"query":{"bool":{"filter":{"range":{"timestamp":{"gte":"now-2m","lte":"now"}}}}},"aggs":{"minutes":{"date\_histogram":{"field":"timestamp","interval":"minute"},"aggs":{"nodes":{"terms":{"field":"source\_node.name","size":10,"order":{"memory":"desc"}},"aggs":{"memory":{"avg":{"field":"node\_stats.jvm.mem.heap\_used\_percent"}}}}}}}}]]]; nested: QueryParsingException[[.marvel-2016.06.01] [bool] query does not support [filter]]; }

GET /.marvel\*/node\_stats/\_search returns 6717451 results, and I see the heap\_used\_percent values.

If I remove the bool parameter, the error says "no query registered for [filter]".

Thanks,  
Casie

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 3, 2016, 6:26am UTC](https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047/2 "2016-08-03T06:26:39Z")

</div>

Hey,

are you still running on Elasticsearch 1.7? The support for `filter` in the `bool` query was added in 2.x. You should use a `filtered` query with a `filter` clause as your query.

Formatting hint: Your watches become much more readable if you put them into code blocks using three backticks, see [here](https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet#code).

--Alex

---

<div class="post-metadata">

**Author:** ![casieowen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/casieowen/32/8734_2.png) [@casieowen](https://discuss.elastic.co/u/casieowen)\
**Post date:** [August 3, 2016, 3:54pm UTC](https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047/3 "2016-08-03T15:54:43Z")

</div>

Thanks, and yes, we're using 1.7.2 for now, and hopefully not for long.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:43pm UTC](https://discuss.elastic.co/t/want-to-log-marvel-watch-for-high-memory-usage-results-to-an-index/57047/4 "2017-07-06T13:43:53Z")

</div>