Alerts/Rules - Elasticsearch query grouped on hostname

I have an Elasticsearch query which emails out on an specific Windows Event Log event id.
This is a basic query...
"query_string" : {
"query" : "10028",
"fields": ["event.code"]



What I would like to do is

  1. Group alerts on So a separate alert for each host meeting this criteria.
  2. Include the hostname in the emails.

Is an Elasticsearch query the best way to configure this?
Any ideas?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.