Alerting based on particular keyword fields

Elastic Stack Elasticsearch
1

Hello,

I have a question about Watcher functionality. My index contains a field named type and subtype. We have around 300 different types, each having around 10 subtypes. Each event that comes to elastic contains both of those fields. We would like to setup a watcher which will check every 5 minutes, if any combination of type/subtype exceeds 10 documents count. If that's the case, then it will send a email notification containing type and subtype information along with number of documents. If possible, it should contain those documents in email body, or at least several field from those documents.

Is above possible? If so, is it complicated to define such Watcher?

2

Hey,

you could aggregate on type/subtype using a terms aggregation with a min_doc_count of 10 and see if that is working for you.

--Alex

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.