MonitoringWatchers

fs_usage_watch.json

{
"watch" :{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "metadata": {
    "window_period": "5m",
    "lower_bound": 1.0
  },
  "input": {
    "search": {
      "request": {
        "indices": "<.monitoring-es-*-{now/d}>",
        "types": "doc",
        "body": {
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "timestamp": {
                      "gte": "now-{{ctx.metadata.window_period}}"
                    }
                  }
                },
                {
                  "term": {
                    "type" : "node_stats"
                  }
                }
              ]
            }
          },
		  "aggs": {
            "clusters": {
              "terms": {
                "field": "cluster_uuid",
                "size": 100
              },
			  "aggs": {
                "nodes": {
                  "terms": {
                    "field": "source_node.name",
                    "size": 100
                  },
                  "aggs": {
                    "total_in_bytes": {
                      "max": {
                        "field": "node_stats.fs.total.total_in_bytes"
                      }
                    },
                   "available_in_bytes": {
                      "max": {
                        "field": "node_stats.fs.total.available_in_bytes"
                      }
                    },
                   "free_ratio": {
                     "bucket_script": {
                       "buckets_path": {
                         "available_in_bytes": "available_in_bytes",
                         "total_in_bytes": "total_in_bytes"
                       },
                       "script": "params.available_in_bytes / params.total_in_bytes"
                     }
                   }
                 }
                }
			  }
			}  
          },
          "size": 0
        }
      }
    }
  },
  "condition": {
    "script": {
    "lang": "painless",
    "source": "return ctx.payload.aggregations.clusters.buckets.stream().anyMatch(cluster -> cluster.nodes.buckets.stream().anyMatch(node -> node.free_ratio.value < ctx.metadata.lower_bound));"
	}
  },
  "transform": {
    "script": {
    "lang": "painless",
    "source": "ctx.payload.aggregations.clusters.buckets.stream().forEach(cluster -> cluster.nodes.buckets.stream().filter(it -> it.free_ratio.value < ctx.metadata.lower_bound).map(it -> ['cluster_name':cluster.key,'node_name':it.key,'available_in_gb':Math.round((it.available_in_bytes.value/1073741824) * 100)/100,'total_in_gb':Math.round((it.total_in_bytes.value/1073741824)* 100)/100])).collect(Collectors.toList())"
    }
  },
  "actions": {
	"notify-slack" : {
	   "slack" : {
	     "message" : {
		    "to" : ["@my.test"],
			"text" : "{{#ctx.payload._value}}For node {{node_name}}: {{available_in_gb}}gb of {{total_in_gb}}gb is available:{{/ctx.payload._value}}"
		 }
	   }
	}
  }
}
}