use elasticsearch_indices_docs_primary instead

elastisys · Dec 17, 2024 · 337deb3 · 337deb3
1 parent 7f5baa5
commit 337deb3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/helmfile.d/charts/prometheus-alerts/templates/alerts/opensearch.yaml b/helmfile.d/charts/prometheus-alerts/templates/alerts/opensearch.yaml
@@ -68,7 +68,7 @@ spec:
         description: Opensearch Cluster is in a Red status VALUE = {{`{{ $value }}`}}  LABELS = {{`{{ $labels }}`}}
     {{- range $prefixes := .Values.osIndexAlerts }}
     - alert: OpenSearch{{ $prefixes.prefix | trimSuffix "-" | title }}IndexSizeOverLimit
-      expr: (elasticsearch_indices_store_size_bytes_primary{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"} / (1024 ^ 2) > {{ $prefixes.alertSizeMB }}) * clamp(rate(elasticsearch_indices_docs_total{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"}[1h]) > 0, 1, 1)
+      expr: (elasticsearch_indices_store_size_bytes_primary{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"} / (1024 ^ 2) > {{ $prefixes.alertSizeMB }}) * clamp(rate(elasticsearch_indices_docs_primary{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"}[1h]) > 0, 1, 1)
       for: 15m
       labels:
         severity: warning