{
        "trigger": {
            "schedule": {
                "interval": "1m"
            }
        },
        "input": {
            "search": {
                "request": {
                    "search_type": "query_then_fetch",
                    "indices": [
                        "filebeat"
                    ],
                    "rest_total_hits_as_int": true,
                    "body": {
                        "size": 0,
                        "query": {
                            "bool": {
                                "filter": {
                                    "range": {
                                        "bb.okd-quotas.timestamp": {
                                            "gte": "{{ctx.trigger.scheduled_time}}||-2m",
                                            "lte": "{{ctx.trigger.scheduled_time}}",
                                            "format": "strict_date_optional_time||epoch_millis"
                                        }
                                    }
                                }
                            }
                        },
                        "aggs": {
                            "bucketAgg": {
                                "terms": {
                                    "field": "bb.okd-quotas.cpu.used_pct",
                                    "size": "15",
                                    "order": {
                                        "metricAgg": "desc"
                                    }
                                },
                                "aggs": {
                                    "metricAgg": {
                                        "max": {
                                            "field": "bb.okd-quotas.cpu.used_pct"
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        },
        "condition": {
            "script": {
                "source": "ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; for (int i = 0; i < arr.length; i++) { if (arr[i]['metricAgg'].value > params.threshold) { return true; } } return false;",
                "lang": "painless",
                "params": {
                    "threshold": 75
                }
            }
        },
        "transform": {
            "script": {
                "source": "HashMap result = new HashMap(); ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; ArrayList filteredHits = new ArrayList(); for (int i = 0; i < arr.length; i++) { HashMap filteredHit = new HashMap(); filteredHit.key = arr[i].key; filteredHit.value = arr[i]['metricAgg'].value; if (filteredHit.value > params.threshold) { filteredHits.add(filteredHit); } } result.results = filteredHits; return result;",
                "lang": "painless",
                "params": {
                    "threshold": 75
                }
            }
        },
        "actions": {
            "email_1": {
                "email": {
                    "profile": "standard",
                    "to": [
                        "ken.veski@bigbank.ee"
                    ],
                    "subject": "Watch [{{ctx.metadata.name}}] has exceeded the threshold 75%"
                }
            },
            "pagerduty_1": {
                "pagerduty": {
                    "description": "Watch [{{ctx.metadata.name}}] has exceeded the threshold"
                }
            }
        },
        "metadata": {
            "name": "OKD_node_CPU_requests",
            "watcherui": {
                "trigger_interval_unit": "m",
                "agg_type": "max",
                "time_field": "bb.okd-quotas.timestamp",
                "trigger_interval_size": 1,
                "term_size": "15",
                "time_window_unit": "m",
                "threshold_comparator": ">",
                "term_field": "bb.okd-quotas.cpu.used_pct",
                "index": [
                    "filebeat"
                ],
                "time_window_size": 2,
                "threshold": 75,
                "agg_field": "bb.okd-quotas.cpu.used_pct"
            },
            "xpack": {
                "type": "threshold"
            }
        }