alert_on_entity_in_an_interval.txt

#alert on a specific entity during a time interval with a value of a field > X
POST _watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "5m"
      }
    },
    "input": {
      "search": {
        "request": {
          "indices": [
            "farequote"
          ],
          "body": {
            "aggs": {
              "data_aggs_interval": {
                "date_histogram": {
                  "field": "@timestamp",
                  "fixed_interval": "1d"
                },
                "aggs": {
                  "tag_names": {
                    "terms": {
                      "field": "airline",
                      "size": 20
                    },
                    "aggs": {
                      "avg_resp": {
                        "avg": {
                          "field": "responsetime"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "script": """
        for (def interval : ctx.payload.aggregations.data_aggs_interval.buckets) {
            for (def tag : interval.tag_names.buckets) {
                if (tag.key == "AAL" && tag.avg_resp.value > 110) {
                  return true;
                }
          }
        }
        """
    },
    "actions": {
      "log": {
        "transform": {
          "script": """
            def failed_tags = new ArrayList();
            for (def interval : ctx.payload.aggregations.data_aggs_interval.buckets) {
              for (def tag : interval.tag_names.buckets) {
                if (tag.key == "AAL" && tag.avg_resp.value > 110) {
                  def failed_tag = new HashMap();
                  failed_tag.put("date",interval.key_as_string);
                  failed_tag.put("tag_name",tag.key);
                  failed_tag.put("avg_resp",tag.avg_resp.value);
                  failed_tags.add(failed_tag);
                }
          }
        }
      return failed_tags;"""
        },
        "logging": {
          "text": """
Result:
==========
		{{#ctx.payload._value}}
		airline={{tag_name}} exceeded threshold with responsetime={{avg_resp}} at {{date}}
		{{/ctx.payload._value}}
"""
        }
      }
    }
  }
}

      "actions": [
        {
          "id": "log",
          "type": "logging",
          "status": "success",
          "transform": {
            "type": "script",
            "status": "success",
            "payload": {
              "_value": [
                {
                  "date": "2021-02-09T00:00:00.000Z",
                  "tag_name": "AAL",
                  "avg_resp": 117.18390918918918
                }
              ]
            }
          },
          "logging": {
            "logged_text": """
Result:
==========
		airline=AAL exceeded threshold with responsetime=117.18390918918918 at 2021-02-09T00:00:00.000Z

"""
          }
        }
      ]

Example uses this data: https://raw.githubusercontent.com/PacktPublishing/Machine-Learning-with-the-Elastic-Stack/master/example_data/farequote.json