Alerting on documents with 2 conditions

Elastic Stack Elasticsearch
3

Thanks for the reply Igor! I think that is exactly what I'm looking for, I'm just running into syntax errors now.

"bool" : {
          "must" : [{
            "match": {
               "event_id": 4776
            }
          }], { **<--- Marked as bad string**
            "match": {
               "keyword": "Audit Failure"
            }
          }]          
}

I'll keep troubleshooting, I'm sure its a JSON syntax error somewhere.