Alerts from Kibana/ES


(NF) #1

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in our
company. Now, we would need a feature that would allow us to send an
alert/notification (email or other) when a certain event/trigger is
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a feature
planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy our
need?

Thanks,

Natalia

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(Norberto Meijome) #2

Hi, not sure tbh
Kibana is a js interface so I don't think it makes sense to alert from it.
You could monitor the results stored in ES with nagios/zabbix/ your
monitoring of choice and parse the json result and alert based on that.
We've used logstash's statsd module to send data we are interested - we
have standard checks against a lot of statsd data points so this was a
simple way to integrate it all.
On 27/05/2014 7:02 pm, "NF" natalia.filipiak@gmail.com wrote:

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in
our company. Now, we would need a feature that would allow us to send an
alert/notification (email or other) when a certain event/trigger is
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a
feature planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy our
need?

Thanks,

Natalia

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.comhttps://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CACj2-4JgG9Ub%2BaNdQt_e97n9N37pSgDv4z1nCfhZtDAkYMe1zQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.


(Elvar) #3

Use this input filter in Logstash to search the logs

http://logstash.net/docs/1.4.1/inputs/elasticsearch

On Tuesday, May 27, 2014 9:02:35 AM UTC, NF wrote:

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in
our company. Now, we would need a feature that would allow us to send an
alert/notification (email or other) when a certain event/trigger is
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a
feature planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy our
need?

Thanks,

Natalia

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/cef00f3f-1e7d-44be-9af8-6e963d1e8c24%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(Otis Gospodnetić) #4

Hi,

There's no alerting in Kibana. Have a look at SPM
http://sematext.com/spm/ - it has ES monitoring, threshold and heartbeat
alerting, anomaly detection, and a number of other features. Actually,
re-reading your email - you are looking to get notified when a certain
event is captured? By that do you mean having something like a "saved
query" that matches incoming logs?

Otis

Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/

On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in
our company. Now, we would need a feature that would allow us to send an
alert/notification (email or other) when a certain event/trigger is
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a
feature planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy our
need?

Thanks,

Natalia

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/8e0028e1-aa1a-44ae-bd7a-e4364827076f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(NF) #5

That's right, Otis.

On Friday, May 30, 2014 7:20:27 AM UTC+2, Otis Gospodnetic wrote:

Hi,

There's no alerting in Kibana. Have a look at SPM
http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ

  • it has ES monitoring, threshold and heartbeat alerting, anomaly
    detection, and a number of other features. Actually, re-reading your email
  • you are looking to get notified when a certain event is captured? By
    that do you mean having something like a "saved query" that matches
    incoming logs?

Otis

Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/

On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in
our company. Now, we would need a feature that would allow us to send an
alert/notification (email or other) when a certain event/trigger is
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a
feature planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy
our need?

Thanks,

Natalia

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/ed8a472c-6033-4f85-a97e-d3c81c3b30a9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(Horst Birne) #6

Hi NF,

we did also set up alerting with our zabbix-monitoring-system.

What we use are simple Linux-Scripts using the command "curl" to search in
given elasticsearch-indices.

In the zabbix-system are build triggers that are runs the script on our
elasticsearch-server and interpret the output given from this scripts (e.g.
Number of events with ID 4625) and if this value is a specific value the
trigger alerts.

It´s simple to set up and maybe this is what you are looking for.

If you need any help, feel free to contact me

Am Freitag, 30. Mai 2014 08:31:07 UTC+2 schrieb NF:

That's right, Otis.

On Friday, May 30, 2014 7:20:27 AM UTC+2, Otis Gospodnetic wrote:

Hi,

There's no alerting in Kibana. Have a look at SPM
http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ

  • it has ES monitoring, threshold and heartbeat alerting, anomaly
    detection, and a number of other features. Actually, re-reading your email
  • you are looking to get notified when a certain event is captured? By
    that do you mean having something like a "saved query" that matches
    incoming logs?

Otis

Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/

On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in
our company. Now, we would need a feature that would allow us to send an
alert/notification (email or other) when a certain event/trigger is
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a
feature planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy
our need?

Thanks,

Natalia

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/b6c9170f-ad81-4d92-94d5-424389e817c8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(Otis Gospodnetić) #7

Aha. FWIW, such "saved queries" functionality is being added to Logsene
http://sematext.com/logsene/ as I type. Logsene is currently free if you
want to play around with it. No such thing in Kibana, but of course there
is Percolator.

Otis

Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/

tel: +1 347 480 1610 fax: +1 718 679 9190

On Friday, May 30, 2014 2:31:07 AM UTC-4, NF wrote:

That's right, Otis.

On Friday, May 30, 2014 7:20:27 AM UTC+2, Otis Gospodnetic wrote:

Hi,

There's no alerting in Kibana. Have a look at SPM
http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ

  • it has ES monitoring, threshold and heartbeat alerting, anomaly
    detection, and a number of other features. Actually, re-reading your email
  • you are looking to get notified when a certain event is captured? By
    that do you mean having something like a "saved query" that matches
    incoming logs?

Otis

Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/

On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in
our company. Now, we would need a feature that would allow us to send an
alert/notification (email or other) when a certain event/trigger is
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a
feature planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy
our need?

Thanks,

Natalia

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/bad95114-98e1-4704-9f8c-9b98c3c72ffb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


(system) #8