Alert on logs error

Hi all.
I have scripts that run every night to back up gitlab and and at the end it logs a file with the result of that backup.
The logs are sent to our Elastic cloud account and from there I want to create an alert when that log has an error about the backup
How can I do that? the back up log is in a json format too.


You can rely on Kibana Alerting Alerting | Kibana Guide [7.15] | Elastic

Thanks Yassine for the info.
The problem is I am not sure how to make the query properly, and selecting the right file onto the query.


The best way for us to help is show us some sample documents log looks like

What is a positive completed result and what is a negative / error result.

Thanks Stephen. I will do that asap


Hi Stephen.
Here is an example of the log

{"timestamp" : "2021-09-26T16:08:50.000Z", "message": "backup failed", "status": "FAILED", "uuid": "fd574e4c-b10d-44fb-b92a-3fe7904885b6", "node": "node1"}

The file is called backup.log and I want to check the status FAILED then send an alert.


I would probably start with the Log Threshold Rule... and check for

WITH status IS FAILED as your condition

IS more than 1


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.