Aggregation to count consecutive instances of a given field value?

Elastic Stack Elasticsearch
1

I have an index that has a series of events:

[{
    @timestamp: "...",
    jobId: "123",
    result: "failure",
},{
    @timestamp: "...",
    jobId: "567",
    result: "success",
},{
   @timestamp: "...",
   jobId: "123",
   result: "failure"
}]

I would like to be able to set up alerting based on conditions like, "the same job has failed 3 times in a row". I believe I could do this as long as I have a query that can tell me, for each unique value of some field (jobId in this example), how many times in a row another field (result) has a particular value (failure). If the most recent result was success, the count would be 0.

One simple (but clunky) approach would be just to query all the logs, sorted by @timestamp, and calculate it myself, but I wonder if it is possible to do by aggregation instead. I thought of using a scripted field but I don't if it's possible to tabulate only recent and consecutive docs across shards.

Any ideas whether this is possible and what techniques to look into to do it?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.