Painless script not working ...

[ernestoalejandrocu]

i have this section of config on my spike rule, but not working for me, any body can help me to solve this.

metric_agg_key: scripted-metric
metric_agg_script:
    script: "doc[\"jolokia.jvm.memory.heap_usage.max\"].value - doc[\"jolokia.jvm.memory.heap_usage.used\"].value"

i get this error...

unsupported operand type(s) for +=: 'int' and 'NoneType'

[nsano-rururu]

https://github.com/Yelp/elastalert/pull/2759

[ernestoalejandrocu]

@nsano-rururu hi buddy, sorry for my bad english, the https://github.com/Yelp/elastalert/pull/2759 means that i had to use elastalert2 or simply upgrade from master? explain me please, or if i must do another thing about it. Thanks

[nsano-rururu]

2759 pull request should have been merged into elastalert2

[nsano-rururu]

Please close

[ernestoalejandrocu]

Hi @nsano-rururu, first, thanks for the upgrade recommendation to elastalert2, now in this moment i want to do the next with not success. I need get two fields (jolokia.jvm.memory.heap_usage.max and jolokia.jvm.memory.heap_usage.used) and substract them, to obtain the amount of jvm memory free. How can i do it, if my sample if wrong, please help me, i dont know if a need another type of rule o simply fix my method ....

#################### name: Alerta - Incremento del consumo de Heap en la JVM type: spike_aggregation index: "metricbeat-7.17.1-*" doc_type: _doc filter:

• query: query_string: query: 'event.module:jolokia AND metricset.name:jmx' metric_agg_type: avg metric_agg_key: myScriptedMetric metric_agg_script: script: doc['jolokia.jvm.memory.heap_usage.max'].value - doc['jolokia.jvm.memory.heap_usage.used'].value realert: minutes: 5 timeframe: minutes: 15 min_doc_count: 1 spike_type: "down" spike_height: 1 threshold_ref: 104857600 alert:
  • "debug" ################

Thanks again @nsano-rururu ......

waiting ....

[nsano-rururu]

Why don't you ask a question with the disccussion of elastalert2. https://github.com/jertel/elastalert2/discussions

[ernestoalejandrocu]

not have idea of this way, a going to post my need there, thanks.