Alert based on two messages

Elastic Stack Kibana
1

Hello,

I have several messages that are ingested together and have same "batchId" field. I need to check a condition (simple calculation), based on two fields from messages that have the same "batchId" (and couple of more fields).

How do I create such alert? Experimented with aggregations and buckets, but can't nail it.

Thank you in advance!

3

May be try filtering your messages first based on batchId and other fields to have only required documents in context. You can then apply any aggregation or calculation on top of that result set.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.