I am struggling with creating an alert on Kibana. I have the license and have Slack notification connected. I have logs coming in from a HIDS and from those logs, which has logs for many different kind of activities, I only need to extract information regarding any new file created. I am assuming here that I will be using a 'Metric Threshold' alerting here to trigger an alert if the alert mechanism detects a log for any new file created in let's say, past 5 minutes.
How can I create an alert for that because in the 'Metric Threshold' settings option I don't see an option to put in a query that can help the mechanism to extract only the new file added logs from the entire set.
I saw a filter option where I can add in KQL, but I don't know how to add the index value in KQL because again, in setting I don't find an option for select index.