Metric Events Query Failed - missing alerts

[Vijayt]

Hi 

i am configuring Warning alerts for OS mount points only not application mount points. 

Configured it using DSQL with filtering disk names /, /opt, /var but i am getting metric event QUERY_FAILED.

builtin:host.disk.usedPct:filter(and(
or(or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/opt~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/var~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/root~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/home~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/tmp~")")))),
or(in("dt.entity.host",entitySelector("type(host),networkZone(~"nw-2105~")")),
or(in("dt.entity.host",entitySelector("type(host),tag(~"team:Linux11~")")))))
:splitBy("dt.entity.host","dt.entity.disk")

Tagged those disks and with tag DSQL still the same Query_FAILED 

i could not configure metric key based one as entity filer only for server not for disks 

How to solve this issue 

[AntonPineiro]

Hi,

For alerting about mount points, maybe you use Filesystem monitoring extension.

Best regards

[t_pawlak]

Hi,

QUERY_FAILED usually means the issue is with the metric selector itself, not with disk alerting.

In your case, the selector is overly complex and has incorrect or(...) nesting. Also make sure you're using proper entity selector syntax (type("DISK"), type("HOST")).

:Start with a single mount point (e.g. /) and validate it in Data Explorer (Advanced mode). Then gradually add more (/opt, /var, etc.), then use it in a metric event.

Something like this:

builtin:host.disk.usedPct
:filter(
  and(
    in("dt.entity.disk",entitySelector("type(\"DISK\"),entityName.equals(\"/\")")),
    in("dt.entity.host",entitySelector("type(\"HOST\"),tag(\"team:Linux11\")"))
  )
)
:splitBy("dt.entity.host","dt.entity.disk")

If your goal is to alert on specific mount points (e.g. only /, /var), a better approach would be what @AntonPineiro  suggested, using the Filesystem Monitoring extension. It natively supports mount point checks and allows alerting per path, without the need for complex selectors.