# Alerts and Actions 설정 관련 문의

**URL:** <https://discuss.elastic.co/t/alerts-and-actions/303574>\
**Category:** 한국어 질문 및 토론\
**Created:** [April 29, 2022, 6:26am UTC](https://discuss.elastic.co/t/alerts-and-actions/303574 "2022-04-29T06:26:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![inwoo1](https://avatars.discourse-cdn.com/v4/letter/i/ed655f/32.png) [@inwoo1](https://discuss.elastic.co/u/inwoo1)\
**Post date:** [April 29, 2022, 6:26am UTC](https://discuss.elastic.co/t/alerts-and-actions/303574/1 "2022-04-29T06:26:23Z")

</div>

![이미지1](https://us1.discourse-cdn.com/elastic/original/3X/3/3/3349ab6cf6346b45da1e133de8ed191f8d37fc87.png)

보시는 바와 같이 Alert 설정을 하려고 하는데요, 제가 Logstash의 filter의 mutate에서  
설정한 필드명이 보이지 않습니다.  
iso.로 시작하는 필드도 안보이고, 변경한 forti\_로 시작하는 필드도 안보이네요.  
혹시 이 필드명을 Alert 설정에서 선택할 수 있게 하려면 어떻게 해야할까요??

```auto
  mutate { 
    rename => { 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.22.0" => "forti_fw_uptime" 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.3.0" => "forti_fw_use_cpu" 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.4.0" => "forti_fw_use_memory" 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.8.0" => "forti_fw_sessioncount" 
    } 
  }

```

---

<div class="post-metadata">

**Author:** ![kimjmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimjmin/32/15223_2.png) [@kimjmin](https://discuss.elastic.co/u/kimjmin)\
**Post date:** [April 29, 2022, 6:28am UTC](https://discuss.elastic.co/t/alerts-and-actions/303574/2 "2022-04-29T06:28:48Z")

</div>

해당 필드가 보이게 kibana data view (7.x 이하에서는 kibana index pattern) 설정은 하셨나요?

---

<div class="post-metadata">

**Author:** ![inwoo1](https://avatars.discourse-cdn.com/v4/letter/i/ed655f/32.png) [@inwoo1](https://discuss.elastic.co/u/inwoo1)\
**Post date:** [April 29, 2022, 6:38am UTC](https://discuss.elastic.co/t/alerts-and-actions/303574/4 "2022-04-29T06:38:31Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/a/baf3da20a4c0550ccfdf599402f15ae9f8e2ed88.png)

네 말씀하신 인덱스 패턴 설정은 진행하여서, 캡쳐와 같이 설정 되어있고,  
로그 조회할 때 discover에서도 forti\_xxx 필드들은 잘 보여집니다.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2022, 6:39am UTC](https://discuss.elastic.co/t/alerts-and-actions/303574/5 "2022-05-27T06:39:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.