Alert on Process failures only if existing

Elastic Observability Metrics
1

I'm relatively new to elastic, and I have a plethora of systems (windows) that all have unique monitoring requirements for processes with some overlap. We are running version 7.16.2. I can make alerts on a condition WHEN document count IS BELOW 1 filtered on (KQL) process.name: "x.exe" and host.name: "x"

What I am wondering is if there is a way to only alert if there was a document count before (say in the past 48-72 hours) but failed in the past minute?

We also have some processes that require multiple copies of the process to be running. Is there a way to alert if the total number of process X is at a value and alert if it deviates from that value?

It seems I can't stack timing conditions in the alert. Being able to do this would save me from making hundreds of unique and overlapping alerts.

Thanks!

2

Hi @jeffo,

have you looked at EQL search? It seems to fit your requirements to match time-series events.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.