Elasticsearch Watcher example using "Percentile Ranks"

elasticsearch_watcher_percentile_ranks.md

This watcher trigger an alert when less than 80% of page responses are under 500ms. (Time range not present in the sample below and need to be added )

Index sample

POST latency/_doc
{
  "response_time": 100
}

Watcher

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "latency"
        ],
        "types": [],
        "body": {
          "size": 0,
          "aggs": {
            "load_time_ranks": {
              "percentile_ranks": {
                "field": "response_time",
                "values": [
                  500
                ]
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.aggregations.load_time_ranks.values[\"500.0\"] < 80) { return true; } return false;",
      "lang": "painless"
    }
  },
  "actions": {
    "logging_1": {
      "logging": {
        "level": "info",
        "text": "Watch [{{ctx.metadata.name}}] has exceeded the threshold"
      }
    }
  },
  "transform": {
    "script": {
      "source": "HashMap result = new HashMap(); result.result = ctx.payload.aggregations.load_time_ranks.values[0]; return result;",
      "lang": "painless"
    }
  }
}

Really nice example, helped me a lot thanks. I am still struggling with how I will intergate a timerange filter like :

"filter": [ { "range": { "@timestamp": { "gte": "now-3m" } } }]

Any help would be appreciated.

For anyone coming across this, I have a date range filter working using a similar watcher. Based on the above example, this snippet should work, changing the timestamp field and ranges as needed:

"body": {
    "size": 0,
    "aggs": {
        "load_time_ranks": {
            "percentile_ranks": {
                "field": "response_time",
                "values": [
                    500
                ]
            }
        },
        "range": {
            "date_range": {
                "field": "@timestamp",
                "ranges": [
                    {
                        "from": "now-4h",
                        "to": "now"
                    }
                ]
            }
        }
    }
}