Hi,
We are monitoring hundreds of network devices (routers and switches) and each device has various number of interfaces (ports). I am trying to setup watch that would show on which network device which port is hitting utilization threshold.
I am quite new to elasticsearch so my knowledge is very limited so some of my configurations might not make sense 
I know how to make watch work for CPU when value is per device. But when I cant make watch when I want value per device and one of its many child elements like port.
My goal is after transformation in actions have output similar to this: testswitch.mydomain.net - GigabitEthernet0/1 - 632613414.4, when threshold is for example 500.
I am running elastic version 6.x
This is how my config looks like:
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"<telegraf*{now/d}>"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-{{ctx.metadata.DBF_interval}}",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
"must": {
"query_string": {
"query": "_exists_:interface.ifHCInOctets",
"analyze_wildcard": true,
"default_field": "*"
}
}
}
},
"aggs": {
"NetworkDEV": {
"terms": {
"field": "tag.agent_host",
"size": 3,
"order": {
"_term": "desc"
},
"min_doc_count": 1
},
"aggs": {
"INT_Name": {
"terms": {
"field": "tag.ifDescr",
"size": 3,
"order": {
"_term": "desc"
},
"min_doc_count": 1
},
"aggs": {
"metricAgg_AVG": {
"avg": {
"field": "interface.ifHCInOctets"
}
}
}
}
}
}
}
}
}
}
},
"condition" : {
"always" : {}
},
"actions": {
"my-logging-action": {
"logging": {
"level": "warn",
"text": "These devices hit threshhold: {{#ctx.payload.DBF_hit_devices}}{{key}}:{{NetworkDEV.value}}{{key}}:{{INT_Name.value}} ;-; {{/ctx.payload.DBF_hit_devices}} "
}
}
},
"metadata": {
"DBF_threshold": 500,
"DBF_interval": "5m"
},
"transform": {
"script": {`Preformatted text`
"source": "return ['DBF_hit_devices' : ctx.payload.aggregations.NetworkDEV.buckets.stream().filter(s -> s.metricAgg_AVG.value >ctx.metadata.DBF_threshold).collect(Collectors.toList())]",
"lang": "painless"
}
}
}