Hi all,
I've got a bit of a unique issue. For the system I am developing, data records will be ingested and compared against thresholds to confirm if values are anomalous.
To test out this functionality I've set up an alert that applies a range query to check if a value is acceptable or not.
I've set up an index connector, so that when the alert is triggered, a document is written to a specific index.
The issue I've encountered is that we require one alert document to match up to each document that has a value out of range (so that when exported to our software we can pair up the alert with the offending document). However, when the alert is triggered, it writes just one alert document with the information about all the offending documents.
The syntax I've used is below, to iterate over the information for each document. But what we want is the ability to write these to separate alert documents. Is this possible?
{
"flight_id": "[{{#context.alerts}}{{header.fdr_unique_id}}, {{/context.alerts}}]",
"batch_sequence_counter": "[{{#context.alerts}}{{header.batch_sequence_counter}}, {{/context.alerts}}]",
"record_sequence_counter": "[{{#context.alerts}}{{header.record_sequence_counter}}, {{/context.alerts}}]",
"timestamp": "[{{#context.alerts}}{{timestamp}}, {{/context.alerts}}]",
"rule": "[{{#context.alerts}}{{signal.rule.description}}, {{/context.alerts}}]",
"navigation_position_estimated_error": "[{{#context.alerts}}{{navigation_position_estimated_error}}, {{/context.alerts}}]"
}
We don't want to use any post-processing if we can avoid it, so any way we can solve this using Elastic functionality would be great.
