From 337deb3c0c652ad28e02e74c40b94dc6a707f3c6 Mon Sep 17 00:00:00 2001
From: Mohammad Reza Saleh Sedghpour <mohammad.saleh@elastisys.com>
Date: Tue, 17 Dec 2024 09:50:59 +0100
Subject: [PATCH] use elasticsearch_indices_docs_primary instead

---
 .../charts/prometheus-alerts/templates/alerts/opensearch.yaml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/helmfile.d/charts/prometheus-alerts/templates/alerts/opensearch.yaml b/helmfile.d/charts/prometheus-alerts/templates/alerts/opensearch.yaml
index d93adfd5b..b62c66408 100644
--- a/helmfile.d/charts/prometheus-alerts/templates/alerts/opensearch.yaml
+++ b/helmfile.d/charts/prometheus-alerts/templates/alerts/opensearch.yaml
@@ -68,7 +68,7 @@ spec:
         description: Opensearch Cluster is in a Red status VALUE = {{`{{ $value }}`}}  LABELS = {{`{{ $labels }}`}}
     {{- range $prefixes := .Values.osIndexAlerts }}
     - alert: OpenSearch{{ $prefixes.prefix | trimSuffix "-" | title }}IndexSizeOverLimit
-      expr: (elasticsearch_indices_store_size_bytes_primary{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"} / (1024 ^ 2) > {{ $prefixes.alertSizeMB }}) * clamp(rate(elasticsearch_indices_docs_total{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"}[1h]) > 0, 1, 1)
+      expr: (elasticsearch_indices_store_size_bytes_primary{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"} / (1024 ^ 2) > {{ $prefixes.alertSizeMB }}) * clamp(rate(elasticsearch_indices_docs_primary{namespace="opensearch-system", index=~"{{ $prefixes.prefix }}.+"}[1h]) > 0, 1, 1)
       for: 15m
       labels:
         severity: warning