Alert condition on numerical Field (value over)

Hi everyone,
i need information about alert Condition. We have a stream with a numerical field (size value inside). We want to raise simple alerts when value is over 1000.

On “Field Content Alert Condition” we couldn’t define a “>” parameter , just a “field” = “value” .

On “Field Aggregation Alert Condition”, we have aggregation function (min, max, sum…) but trigger condition doesn’t work …we tried a lot of combinaison to perform a “raise an alert if value of the field is over 1000 on last 5 minutes” but for me the aggregation function is not adapted to us.

Someone have an idea ?

is the field in elasticsearch saved as a number? If this is saved as a string the aggregation is not possible.

Hi @jan jan, how i can check that ?

You could check the index mapping in Elasticsearch:

1 Like

You have right @jochen , all values extracted by "csv plugin " on my pipeline are created in “keyword Type” :

I should add a stage on my pipeline and convert desired fields to a number. Witch pipeline function is the best way to convert “keyword” to “number” ? Base*-encode function or “to_double*” function ?


I’m pretty sure that you don’t want to have base64 encoding. :wink:

Depending on the type of number (floating point or integer), you could use to_double() or to_long().

1 Like

:smile: you have right.

thanks a lot.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.