Create Monitor - Define extraction query

Hello,

I am attempting to create a monitor in Kibana using the "Define using extraction query" option.

However I am struggling to form the query.

I am trying to monitor the last hour of logs, and look for the field "action.keyword" where value = "BLOCK".

From looking at the script that is created from the "Define using visual graph" I believe I have found how to look at the past hour:

            "filter": [
                {
                    "range": {
                        "timestamp": {
                            "from": "{{period_end}}||-1h",
                            "to": "{{period_end}}",
                            "include_lower": true,
                            "include_upper": true,
                            "format": "epoch_millis",
                            "boost": 1
                        }
                    }
                }
            ],

However I am unsure how to then look only at "action.keyword", and then only "BLOCK" values for that.

Could someone please let me know what parameters I should be using here?

Thanks :slight_smile:

Can you try this?

{
"size": 10,
"query": {
"bool": {
"must": {
"query_string": {
"query": "BLOCK",
"boost": 1
}
},
"filter": [
{
"range": {
"@timestamp": {
"from": "{{period_end}}||-1h",
"to": "{{period_end}}",
"include_lower": true,
"include_upper": true,
"boost": 1
}
}
}
]
}
}
}

Hi George, thanks for getting back to me.

I tried running this but got no hits in response:

{
"_shards": {
"total": 10,
"failed": 0,
"successful": 10,
"skipped": 0
},
"hits": {
"hits": ,
"total": 0,
"max_score": null
},
"took": 0,
"timed_out": false
}

I generated some logs with "BLOCK" in the field "action.keyword" to ensure that the query was able to find results, but still returned 0 hits unfortunately.

Can you check if you are able to see the data coming up in discover?
Also check if you are using the right index.

Hi George,

I can see the data in discover, and confirmed I'm using the right index. I'm looking at multiple indexes by using a wildcard, in my case I'm looking at "awswaf-*" specifically.