{
  "trigger": {
    "schedule": {
      "cron": [
        "0 */1 * * * ?"
      ]
    }
  },
  "checks": [
    {
      "type": "static",
      "name": null,
      "target": "constants",
      "value": {
        "num_of_hosts": 100,
        "threshold": 10000,
        "window": "30m"
      }
    },
    {
      "type": "search",
      "name": "memory_usage",
      "target": "memory_usage",
      "request": {
        "indices": [
          "kibana_sample_data_logs"
        ],
        "body": {
          "size": 0,
          "aggs": {
            "hosts": {
              "terms": {
                "field": "host.keyword",
                "size": "{{data.constants.num_of_hosts}}",
                "order": {
                  "memory_usage": "asc"
                }
              },
              "aggs": {
                "memory_usage": {
                  "max": {
                    "field": "memory"
                  }
                }
              }
            }
          },
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "timestamp": {
                      "gte": "now-{{data.constants.window}}"
                    }
                  }
                },
                {
                  "range": {
                    "memory": {
                      "gt": "{{data.constants.threshold}}"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    },
    {
      "type": "condition",
      "name": "mycondition",
      "source": "data.memory_usage.aggregations.hosts.buckets.length > 0"
    }
  ],
  "actions": [
    {
      "type": "webhook",
      "name": "myslack",
      "throttle_period": "1s",
      "request": {
        "method": "POST",
        "url": "https://hooks.slack.com/services/token",
        "body": "{\"text\": \"\nHosts with memory usage higher than {{data.constants.threshold}} over last {{data.constants.window}}:\n  {{#data.memory_usage.aggregations.hosts.buckets}}\n    {{key}} {{memory_usage.value}}\n  {{/data.memory_usage.aggregations.hosts.buckets}}\"\n}\n",
        "headers": {
          "Content-type": "application/json"
        }
      }
    }
  ],
  "active": true,
  "log_runtime_data": false,
  "_id": "memory_usage"
}
