Hi Everyone,
So here is the scenario , I have metricbeat installed on 2 different servers. The feed is going from the logstash to the AWS Elasticsearch. Now , I'm setting up the alerting in kibana for cpu utilization.
{ "query":
{"bool":
{"must":
[{"range":
{"system.memory.actual.used.pct": {"gte": 0.5}}},
{"range":
{"@timestamp":
{"gte": "now-1h","lte": "now/m"}}}]
}
}}
now the alert is triggering but one for one host. Though the condition is satisfied for both meaning the alert should trigger for both separately.
So that in case there are 5 servers with metric beat and over the threshold the alert should come. Any changes to the script or to the trigger part. Please suggest how that can be done.