Hii, I am creating alerts for my data view. I configured the rule as if salary property in data view extends some value an document with alert info will be saved in alert index. But when I enable my rule no alert index is getting created. I tried with creating the alert index by my own but, rule is not indexing the info in that index too. I am using 8.4.3 version of Kibana and Elasticsearch. My rule is not showing any error. It is showing status as Ok.
Any suggestion what I might be doing wrong, I read similar post related to this issue but they didn't work in my case. According to the documentation my configurations should work
Thanks
this is employee index for which I am checking the condition on salary < 20000.
{
"employees": {
"mappings": {
"properties": {
"created_at": {
"type": "date"
},
"dateTime": {
"type": "long"
},
"id": {
"type": "text"
},
"name": {
"type": "text"
},
"salary": {
"type": "double"
}
}
}
}
}
I created data view with created_at as the time field.
I am using Index rule type, this is the document which I want to index in alert index which I have not created.
{
"rule_id": "{{rule.id}}",
"context_message": "{{context.message}}",
"rule_name": "{{rule.name}}",
"alert_id": "{{alert.id}}"
}
When test my query while configuring the rule it returns documents so I guess my query is working. My rule run every 10 seconds and sends reponse as Ok
