Hi,
We are getting NPS logs and want to monitor when a certain string appears. We want to create an alert if we receive a log containing the field "CISCOTAG" containing the value "%ASA-2-113022". But, we only want to send an alert for that log, if there has been no "up" log for that particular device in 15 minutes.
So here is what i have so far:
A chain input where the first search gets all documents containing the value "%ASA-2-113022", this is the "down" event. And a second input which gets all documents containing the value "%ASA-2-113023", which is the "up" event.
{
"trigger": {
"schedule": {
"interval": "10m"
}
},
"input" : {
"chain" : {
"inputs" : [
{
"first" : {
"search" : {
"request" : {
"indices" : [ "index-*" ],
"body" : {
"query": {
"bool": {
"must": [
{
"match": {
"ciscotag": "ASA-2-113022"
}
}
],
"filter": {
"range": {
"@timestamp": {
"gte": "now-24h"
}
}
}
}
}
}
}
}
}
},
{
"second" : {
"search" : {
"request" : {
"indices" : [ "index-*" ],
"body" : {
"query": {
"bool": {
"must": [
{
"match": {
"ciscotag": "ASA-2-113023"
}
}
],
"filter": {
"range": {
"@timestamp": {
"gte": "now-24h"
}
}
}
}
}
}
}
}
}
}
]
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"administrator@example.com"
],
"subject": "Alert",
"body": {
"text": "Test"
}
}
}
}
}
However, i'm quite stuck right now. I don't understand what to put in the condition field. I would appreciate any help