Thank you for this great support where we get reply in few minutes. We're very grateful to all of you guys.
We're using latest version of ELK. In alert and action > Log Threshold, less than feature doesn't work as highlighted in the screenshot
We're intended to get alert when a logsource stop sending logs, here if we change it with more than X number of logs entries then it works and trigger an alert but less than doesn't work.
Here are two observations:
1st observation, if logsource i.e host.name wp-pri stop sending logs then in realtime wp-pri will not be appearing in the realtime logs that's why my condition becomes false. It make sense.
But here I'm doing it like wp-pri hostname is appreaing in the real time logs. I know in last 30 minutes this hostname doesn't have more than 2000 json documents, it should have trigger an alert now. When I change it like if more than 1000 logs occur then it trigger an alert successfully.
Please help me what's happening here and how can I accomplish my goal.