# Watcher disk usage alerting

**URL:** <https://discuss.elastic.co/t/watcher-disk-usage-alerting/297833>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [February 22, 2022, 4:37am UTC](https://discuss.elastic.co/t/watcher-disk-usage-alerting/297833 "2022-02-22T04:37:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ss02072805](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@ss02072805](https://discuss.elastic.co/u/ss02072805)\
**Post date:** [February 22, 2022, 4:37am UTC](https://discuss.elastic.co/t/watcher-disk-usage-alerting/297833/1 "2022-02-22T04:37:07Z")

</div>

This is for Metricbeat filesystem used, whenever threshold level goes above 40 % it should trigger alerts ,

` **Execution failing:** `  
"error": {  
"root\_cause": [  
{  
"type": "general\_script\_exception",  
"reason": "Error running com.github.mustachejava.codes.DefaultMustache@6eb548c2"  
}  
],  
"type": "general\_script\_exception",  
"reason": "Error running com.github.mustachejava.codes.DefaultMustache@6eb548c2",  
"caused\_by": {  
"type": "mustache\_exception",  
"reason": "Failed to get value for ctx.payload.hits.hits.0.\_source.host.name @[query-template:1]",  
"caused\_by": {  
"type": "mustache\_exception",  
"reason": "0 @[query-template:1]",  
"caused\_by": {  
"type": "index\_out\_of\_bounds\_exception",  
"reason": "0"

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\__Watcher disk usage query_

> Blockquote

{  
"trigger": {  
"schedule": {  
"interval": "2m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"metricbeat-\*"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"filter": [  
{  
"range": {  
"@timestamp": {  
"from": "now-15m"  
}  
}  
},  
{  
"range": {  
"system.filesystem.used.pct": {  
"from": 0.45  
}  
}  
}  
],  
"must": [  
{  
"match\_phrase": {  
"system.filesystem.mount\_point": "/MDHUATAP001"  
}  
}  
]  
}  
},  
"aggs": {  
"by\_host": {  
"terms": {  
"field": "host.hostname",  
"size": "100"  
}  
},  
"by\_disk": {  
"terms": {  
"field": "system.filesystem.mount\_point",  
"size": "100"  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},  
"actions": {  
"send\_email": {  
"throttle\_period\_in\_millis": 9000,  
"email": {  
"profile": "standard",  
"to": [  
"[sabaridoss.govindaraj@satr.com](mailto:sabaridoss.govindaraj@satr.com)",  
"[sabaridoss.govindaraj@satr.com](mailto:sabaridoss.govindaraj@satr.com)"  
],  
"subject": "[SSM][NON PROD][{{ctx.payload.hits.hits.0.\_source.host.name}}] Application restarted",  
"body": {  
"testing"  
}  
}  
}  
}  
}

> Blockquote

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 23, 2022, 8:44am UTC](https://discuss.elastic.co/t/watcher-disk-usage-alerting/297833/2 "2022-02-23T08:44:30Z")

</div>

Hey,

please use some markdown formatting for your JSON, as this is really hard to read.

Can you also share the output of the execute watch API or the watcher history for a single execution that failed? That would be great!

Current guess: Is it possible that the first document returned does not have the `ctx.payload.hits.hits.0._source.host.name` (so the `host.name` field) in its source?

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2022, 8:44am UTC](https://discuss.elastic.co/t/watcher-disk-usage-alerting/297833/3 "2022-03-23T08:44:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.