Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions

Elastic Stack Elasticsearch
1

Hello everyone, Have a nice day !
I have a problem,
Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions ?

Example:
I want to get some conditions from my config like:
if "message" contains "some text" and "age" > 18 then trigger an alert to "alerts" index and append "18+" to field "tags" on this document.

Thanks all.

2

hello

3

Why not use the Alerting functionality in the stack to do that?

4

Ingest processors can alter the event so it is possible to add a tag. You can however not spawn new documents for other indices. For that you might need to use Logstash which has that capability through the clone filter.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.