74 lines
2.0 KiB
JSON
74 lines
2.0 KiB
JSON
{
|
|
"trigger": {
|
|
"schedule": {
|
|
"interval": "1m"
|
|
}
|
|
},
|
|
"input": {
|
|
"search": {
|
|
"request": {
|
|
"indices": [
|
|
".marvel-*"
|
|
],
|
|
"search_type": "count",
|
|
"body": {
|
|
"query": {
|
|
"filtered": {
|
|
"filter": {
|
|
"range": {
|
|
"timestamp": {
|
|
"gte": "now-2m",
|
|
"lte": "now"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"aggs": {
|
|
"minutes": {
|
|
"date_histogram": {
|
|
"field": "timestamp",
|
|
"interval": "minute"
|
|
},
|
|
"aggs": {
|
|
"nodes": {
|
|
"terms": {
|
|
"field": "node.name.raw",
|
|
"size": 10,
|
|
"order": {
|
|
"memory": "desc"
|
|
}
|
|
},
|
|
"aggs": {
|
|
"memory": {
|
|
"avg": {
|
|
"field": "jvm.mem.heap_used_percent"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"throttle_period": "30m",
|
|
"condition": {
|
|
"script": "if (ctx.payload.aggregations.minutes.buckets.size() == 0) return false; def latest = ctx.payload.aggregations.minutes.buckets[-1]; def node = latest.nodes.buckets[0]; return node && node.memory && node.memory.value >= 75;"
|
|
},
|
|
"actions": {
|
|
"send_email": {
|
|
"transform": {
|
|
"script": "def latest = ctx.payload.aggregations.minutes.buckets[-1]; return latest.nodes.buckets.findAll { return it.memory && it.memory.value >= 75 };"
|
|
},
|
|
"email": {
|
|
"to": "user@example.com",
|
|
"subject": "Watcher Notification - HIGH MEMORY USAGE",
|
|
"body": "Nodes with HIGH MEMORY Usage (above 75%):\n\n{{#ctx.payload._value}}\"{{key}}\" - Memory Usage is at {{memory.value}}%\n{{/ctx.payload._value}}"
|
|
}
|
|
}
|
|
}
|
|
}
|