X-Pack Watch jobs for CPU usage

Elastic Stack Elasticsearch
1

Hi, I want to make a watch job for CPU usage>20%.
Please help me code with http input.
thanks

2

Hey,

please be more specific what your exact problem is, from the business side as well as from the technical side.

  • Do you want to alert if CPU is above 20% one time or all the time or for a certain period in a row?
  • Do you want to alert this for only one hosts or for all hosts? How should the alert look like if a host recovers?
  • How does your data look like?
  • Where do you get the data from?

Without taking the time and writing up more context it will be impossible to help you. Also you need to be more specific where you have problems from the technical side. What exactly is your issue with the HTTP input? If you have an error message, then provide (no screenshots please, copy and paste everything properly).

Also, please take a look at our examples https://github.com/elastic/examples/tree/master/Alerting

--Alex

5

Thanks alex.
I could manage to make the watcher for CPU usage using one of the examples you had in one of the post.
but the thing is I did that using search input. I search a local index and using aggregations and timestamp and node_stats.process.cpu.percent I could acheive the name of the nodes and their value for all the higher CPU usage nodes.
but now the thing is I have to do it in Http input and not search input.
In the input I want to specify a load balancer ip of one cluster, path etc.
so do I do that? when I replace the input from search to http and define the ip, port etc along with a body(which contains all the aggreagtion and timestamp range) I am getting an error : illegal argument, for size : no parser found. when I remove size from the body I get the same error, now for query : no parser found.
Please tell me how do I tweak my existing code to fit in http input instead of search input. they both will be doing the same job, but now I want to access other cluster, thats why I want to use http(where I can define the ip address of that cluster).
Please help me!

Thanks

7

the body field must be a string and cannot be an object currently.

9

The documentation contains an example, see https://www.elastic.co/guide/en/x-pack/6.2/input-http.html

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.