Alerts/Rules - Elasticsearch query grouped on hostname

Elastic Stack Kibana
,
1

I have an Elasticsearch query which emails out on an specific Windows Event Log event id.
This is a basic query...
{
"query":{
"query_string" : {
"query" : "10028",
"fields": ["event.code"]

    }
}

}

What I would like to do is

  1. Group alerts on host.name. So a separate alert for each host meeting this criteria.
  2. Include the hostname in the emails.

Is an Elasticsearch query the best way to configure this?
Any ideas?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.