Create a rule / alert using dashboard formula

Elastic Stack Kibana
1

Hi, i need to create an alert using the rule page but im not able to replicate the formula that im using on the dashboard.
Someone can help me?

unique_count(event.metadata.correlationId, kql='
event.metadata.tracePoint : "END"  
and ((event.logMessage : MESSAGE*) or (event.logMessage : "MESSAGE"))') / unique_count(event.metadata.correlationId,
kql='event.metadata.tracePoint : "START"  
and event.logMessage : MESSAGE*')

Thanks in advance

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.