Alerting based on the keyword in logs

[v_anil (Anil Kumar)]

Hi ,

Is there anyway we can configure an alert based on the keyword in the logs, and alert them if we found more than threshould.

for ex: If the logs contain "Exception or ERROR" more than 10 times in last 2 min , i want to send an alert with the pod name and the logs message.

Currently i am using kibana 6.8 , but yeah i know the current version is not supporting the alerts. I just wanted to make sure the above alert is possible to setup. If yes then i will upgrade the elasticsearch and kibana.

Can someone please suggest whether it is possible or not..? if yes is there any doc that i can follow..?

[borna_talebi]

Hi,
I think you can use the Threshold rule for your scenario.

[Kerry (Kerry Gallagher)]

Hi,

If you were to upgrade you’d be able to use a Log threshold alert for this functionality.

[v_anil (Anil Kumar)]

@borna_talebi and @Kerry thanks for your valuable options.

Log threshold worked.