# Watcher Not Trigger for CPU utilization **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [June 22, 2018, 2:19am UTC](https://discuss.elastic.co/t/watcher-not-trigger-for-cpu-utilization/136960 "2018-06-22T02:19:36Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Pushpak\_Bhawsar](https://avatars.discourse-cdn.com/v4/letter/p/5e9695/32.png) [@Pushpak\_Bhawsar](https://discuss.elastic.co/u/Pushpak_Bhawsar)\ **Post date:** [June 22, 2018, 2:19am UTC](https://discuss.elastic.co/t/watcher-not-trigger-for-cpu-utilization/136960/1 "2018-06-22T02:19:36Z")
Hello, I am trying to set a metricbeat watcher to get CPU utilization for a host, but it is not triggering. Below is the JSON and the simulate result, Kindly suggest what am I missing or doing wrong: JSON: { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": [ "metricbeat-wp-acc\*" ], "types": [], "body": { "size": 0, "query": { "bool": { "filter": { "range": { "@timestamp": { "gte": "{{ctx.trigger.scheduled\_time}}||-5m", "lte": "{{ctx.trigger.scheduled\_time}}", "format": "strict\_date\_optional\_time||epoch\_millis" } } } } }, "aggs": { "bucketAgg": { "terms": { "field": "beat.hostname", "size": 5, "order": { "metricAgg": "desc" } }, "aggs": { "metricAgg": { "avg": { "field": "system.cpu.total.pct" } } } } } } } } }, "condition": { "script": { "source": "ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; for (int i = 0; i \< arr.length; i++) { if (arr[i]['metricAgg'].value \> params.threshold) { return true; } } return false;", "lang": "painless", "params": { "threshold": 0.3 } } }, "actions": { "email\_1": { "email": { "account": "gmail\_account", "profile": "gmail", "to": [ "xyz@gmail.com" ], "subject": "Watch [{{ctx.metadata.name}}] has exceeded the threshold", "body": { "text": "The hosts have exceeded the CPU threshold" } } } }, "metadata": { "watcherui": { "trigger\_interval\_unit": "m", "agg\_type": "avg", "time\_field": "@timestamp", "trigger\_interval\_size": 1, "term\_size": 5, "time\_window\_unit": "m", "threshold\_comparator": "\>", "term\_field": "beat.hostname", "index": [ "metricbeat-wp-access\*" ], "time\_window\_size": 5, "threshold": 0.3, "agg\_field": "system.cpu.total.pct" } }, "transform": { "script": { "source": "HashMap result = new HashMap(); ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; ArrayList filteredHits = new ArrayList(); for (int i = 0; i \< arr.length; i++) { HashMap filteredHit = new HashMap(); filteredHit.key = arr[i].key; filteredHit.value = arr[i]['metricAgg'].value; if (filteredHit.value \> params.threshold) { filteredHits.add(filteredHit); } } result.results = filteredHits; return result;", "lang": "painless", "params": { "threshold": 0.3 } } } } ---
**Author:** ![Pushpak\_Bhawsar](https://avatars.discourse-cdn.com/v4/letter/p/5e9695/32.png) [@Pushpak\_Bhawsar](https://discuss.elastic.co/u/Pushpak_Bhawsar)\ **Post date:** [June 22, 2018, 2:23am UTC](https://discuss.elastic.co/t/watcher-not-trigger-for-cpu-utilization/136960/2 "2018-06-22T02:23:06Z")
Simulate result: { "watch\_id": "_inlined_", "node": "\_LuW32Y-RbeU2JuugU7NPQ", "state": "execution\_not\_needed", "status": { "state": { "active": true, "timestamp": "2018-06-22T02:20:34.354Z" }, "last\_checked": "2018-06-22T02:20:34.361Z", "actions": { "email\_1": { "ack": { "timestamp": "2018-06-22T02:20:34.354Z", "state": "awaits\_successful\_execution" } } }, "execution\_state": "execution\_not\_needed", "version": -1 }, "trigger\_event": { "type": "manual", "triggered\_time": "2018-06-22T02:20:34.358Z", "manual": { "schedule": { "scheduled\_time": "2018-06-22T02:20:34.358Z" } } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": [ "metricbeat-wp-access\*" ], "types": [], "body": { "size": 0, "query": { "bool": { "filter": { "range": { "@timestamp": { "gte": "{{ctx.trigger.scheduled\_time}}||-5m", "lte": "{{ctx.trigger.scheduled\_time}}", "format": "strict\_date\_optional\_time||epoch\_millis" } } } } }, "aggs": { "bucketAgg": { "terms": { "field": "beat.hostname", "size": 5, "order": { "metricAgg": "desc" } }, "aggs": { "metricAgg": { "avg": { "field": "system.cpu.total.pct" } } } } } } } } }, "condition": { "script": { "source": "ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; for (int i = 0; i \< arr.length; i++) { if (arr[i]['metricAgg'].value \> params.threshold) { return true; } } return false;", "lang": "painless", "params": { "threshold": 0.3 } } }, "metadata": { "name": "t22", "watcherui": { "trigger\_interval\_unit": "m", "agg\_type": "avg", "time\_field": "@timestamp", "trigger\_interval\_size": 1, "term\_size": 5, "time\_window\_unit": "m", "threshold\_comparator": "\>", "term\_field": "beat.hostname", "index": [ "metricbeat-wp-access\*" ], "time\_window\_size": 5, "threshold": 0.3, "agg\_field": "system.cpu.total.pct" }, "xpack": { "type": "json" } }, "result": { "execution\_time": "2018-06-22T02:20:34.361Z", "execution\_duration": 71, "input": { "type": "search", "status": "success", "payload": { "\_shards": { "total": 6, "failed": 0, "successful": 6, "skipped": 0 }, "hits": { "hits": [], "total": 1131, "max\_score": 0 }, "took": 8, "timed\_out": false, "aggregations": { "bucketAgg": { "doc\_count\_error\_upper\_bound": 0, "sum\_other\_doc\_count": 0, "buckets": [ { "doc\_count": 540, "metricAgg": { "value": 0.043533333333333334 }, "key": "wp-accessXXXXXXXXX-vm" }, { "doc\_count": 591, "metricAgg": { "value": 0.013166666666666667 }, "key": "wp-accessXXXXXXXXXX-vm" } ] } } }, "search": { "request": { "search\_type": "query\_then\_fetch", "indices": [ "metricbeat-wp-access\*" ], "types": [], "body": { "size": 0, "query": { "bool": { "filter": { "range": { "@timestamp": { "gte": "2018-06-22T02:20:34.358Z||-5m", "lte": "2018-06-22T02:20:34.358Z", "format": "strict\_date\_optional\_time||epoch\_millis" } } } } }, "aggs": { "bucketAgg": { "terms": { "field": "beat.hostname", "size": 5, "order": { "metricAgg": "desc" } }, "aggs": { "metricAgg": { "avg": { "field": "system.cpu.total.pct" } } } } } } } } }, "condition": { "type": "script", "status": "success", "met": false }, "actions": [] }, "messages": [] } ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [June 22, 2018, 12:55pm UTC](https://discuss.elastic.co/t/watcher-not-trigger-for-cpu-utilization/136960/3 "2018-06-22T12:55:20Z")
Your treshold is 0.3 And your avg is 0.01 and 0.04 So logically if you do this ` for (int i = 0; i < arr.length; i++) { if (arr[i]['metricAgg'].value > params.threshold) { return true; } } return false;"` then > [@Pushpak\_Bhawsar](#): > > "condition": { > "type": "script", > "status": "success", > "met": false > }, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2018, 12:03am UTC](https://discuss.elastic.co/t/watcher-not-trigger-for-cpu-utilization/136960/5 "2018-07-24T00:03:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.