Hi can anyone help how can we create a watcher script for the below requirement
I having a field called "log_message" contaning the below message
Failed to load TermRecord for TermID=
here the terminal id can be any characters , it may be number , alphabets or special characters
i want to get an alert in kibana, if the same log message containing the same terminal id occurs more than 5 times in a 5 minute interval of time. i dont know how to aggregate these in the watcher script. below is my watcher script.i used the regex pattern in the "query string" as the terminal id can be anything. but i am getting an error. is there any other way? Thanks.
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"testingalert*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": {
"query_string": {
"query": "Failed to load TermRecord for TermID=^[a-zA-Z0-9_.-]*$"
}
},
"filter": {
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-5m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
},
"aggs": {
"bucketAgg": {
"terms": {
"field": "log_message.keyword",
"size": "5",
"order": {
"_count": "desc"
}
}
}
}
}
}
}
},
"condition": {
"script": {
"source": "ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; for (int i = 0; i < arr.length; i++) { if (arr[i].doc_count > params.threshold) { return true; } } return false;",
"lang": "painless",
"params": {
"threshold": 5
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"anonymousbeendetected@gmail.com"
],
"subject": "Watcher Notification",
"body": {
"text": "Watch [{{ctx.metadata.name}}] The 'Warning' alert has occured more than 5 times in 5 minutes interval of time"
}
}
}
},
"transform": {
"script": {
"source": "HashMap result = new HashMap(); ArrayList arr = ctx.payload.aggregations.bucketAgg.buckets; ArrayList filteredHits = new ArrayList(); for (int i = 0; i < arr.length; i++) { HashMap filteredHit = new HashMap(); filteredHit.key = arr[i].key; filteredHit.value = arr[i].doc_count; if (filteredHit.value > params.threshold) { filteredHits.add(filteredHit); } } result.results = filteredHits; return result;",
"lang": "painless",
"params": {
"threshold": 5
}
}
}
}
