Kibana: version 7.17.3
I am trying to create a Rule in Kibana Alerts and Insights, but I'm having some difficults.
To contextualize:
1- I want to calculate the total of documents in last 5 minutes
2- Calculate the number of documents with response_code field > 400
3- Alert should be activated when the number of documents with response_code field > 400 is above 2% of total documents
What I have for now:
My query is:
{
"aggs": {
"total_requests": {
"value_count": {
"field": "id_request"
}
},
"errors": {
"filter": {
"range": {
"response_code": {
"gte": 400,
"lt": 500
}
}
},
"aggs": {
"total_errors": {
"value_count": {
"field": "id_request"
}
}
}
}
},
"script_fields": {
"percentual_errors": {
"script": {
"source": "params._source['errors.total_errors'] / params._source['total_requests.value']",
"lang": "painless"
}
}
},
"query": {
"match_all": {}
},
"post_filter": {
"script": {
"script": {
"source": "params.percentual_errors > 0.02",
"lang": "painless"
}
}
}
}
My problem is that kibana is expecting that I select an number of documents that should match, but I only want to activate the query when the condition is true.
