Alert condition on numerical Field (value over)

[piellick]

Hi everyone,
i need information about alert Condition. We have a stream with a numerical field (size value inside). We want to raise simple alerts when value is over 1000.

On “Field Content Alert Condition” we couldn’t define a “>” parameter , just a “field” = “value” .

On “Field Aggregation Alert Condition”, we have aggregation function (min, max, sum…) but trigger condition doesn’t work …we tried a lot of combinaison to perform a “raise an alert if value of the field is over 1000 on last 5 minutes” but for me the aggregation function is not adapted to us.

Someone have an idea ?

[jan (Jan Doberstein)]

is the field in elasticsearch saved as a number? If this is saved as a string the aggregation is not possible.

[piellick]

Hi @jan jan, how i can check that ?

[jochen]

You could check the index mapping in Elasticsearch:
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-get-mapping.html

[piellick]

You have right @jochen , all values extracted by "csv plugin " on my pipeline are created in “keyword Type” :

I should add a stage on my pipeline and convert desired fields to a number. Witch pipeline function is the best way to convert “keyword” to “number” ? Base*-encode function or “to_double*” function ?

regards

[jochen]

@piellick

Base*-encode function or “to_double*” function ?

I’m pretty sure that you don’t want to have base64 encoding.

Depending on the type of number (floating point or integer), you could use to_double() or to_long().

[piellick]

you have right.

thanks a lot.