Watcher Kibana : How can i use double condition in a "compare"

Elastic Stack Elasticsearch
1

I want to compare two conditon to send an alert mail

My exemple :

  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "AUDITTIMESTAMP": {
              "gte": "now-15m"
            }
          }
        }
      ],
      "filter": [
        {
          "term": {
            "SERVICE_NAME": "my-service-name"
          }
        },
        {
          "term": {
            "STATE": "ERROR"
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 10
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard"

i want to add an another condition (total error >10) and a least 50 totals hits already on the last 15 minutes to firing alert ?

Thx

2

Hi,

I don't understand well the extra condition you want to add

Your current input query looks for "ERROR" value for the field "STATE" from the last 15 minutes.

If you want to look for different data in the same watch, you can use chain inputs.

There is a thread in this forum with a full example: A watch alert example based on two different searches using CHAIN input and Painless script condition

For example, you can set

  • One search input named "errors" with your current query
  • Another one named "all_messages" with a similar query minus the "ERROR" filter to get all messages in the last 15 minutes.

Customize them with your desired searches.

Then, you may use a script condition to be able to evaluate two conditions.

Something like:

  "condition": {
    "script": {
      "source": "return ctx.payload.errors.hits.total >= 15 && ctx.payload.all_messages.hits.total >= 50",
      "lang": "painless"
    }
3

Hello andres-perez,

Thank you very very much, i customize your example condition and it work :slight_smile:

Excuse me for my english if the presentation of my problem was not very clear (i am french :wink: )

4

Last question : how to tranform ctx.payload.error.hits.totals to calculate the error percentage from the total number, for example, I accept 10% error on total calls

5

You can operate directly with the values.

If you just use the integrated editor in kibana (which enforces the 1-line limit of JSON), you can write multiple statements separated with semicolons.

A condition roughly like ((errors * 100) / total_messages) >= 10 should be enough; you have to verify the proper syntax, operators, maybe data types... this is not a literal code example.

If you want to save the resulting percentage value, you can add elements to the watch execution context object whenever you use painless script.

The ctx.vars would be a good place to set new variables.

Again, a pseudocode-ish example

   "script": {
      "source": "ctx.vars.error_percentage = ctx.payload.errors.hits.total * 100 / ctx.payload.all_messages.hits.total; more statements separated by semicolons"

If this is part of the condition, then it must finish with a suitable evaluation:

"source": "...previous statements; return ctx.vars.error_percentage >= 10"

This way, you will be able to use this value later in the actions section (e.g. an email): "bla bla bla the system has registered {{ctx.vars.error_percentage}} % error rate"

J'espère que ça vous aidera :slight_smile:

6

Thx Andreas,

I write like this ??

"condition": {
"script": {
"source": "return (ctx.payload.error_15m.hits.total * 100 / ctx.payload.all_15m.hits.total ) >= 10 && ctx.payload.all_15m.hits.total > 2000",
"lang": "painless"
}
},

7

Awesome guy, it work for me !

My final version :smile:

"condition": {
"script": {
"source": "ctx.vars.error_percentage = ctx.payload.error_15m.hits.total * 100 / ctx.payload.all_15m.hits.total; return ctx.vars.error_percentage >= 10 && ctx.payload.all_15m.hits.total > 2000",
"lang": "painless"
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"username@domain.fr"
],
"subject": "[Kibana - Alert - Grave] Test envoi alerte si % d'erreur > 10",
"body": {
"html": "Détection sur les 15 dernieres minutes de 10 % d'erreur ({{ctx.vars.error_percentage}} % error )
{{ctx.payload.error_15m.hits.total}} erreurs sur un TOTAL de : {{ctx.payload.all_15m.hits.total}} appels Merci de vérifier sur le Dashboard QOS "
}
}
}
}
}

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.