So I'm trying to figure out a way to deal with delays from when a message is received by a collector, when a message is finally indexed in Elastic and when watcher finally runs the query that generates an alert. As an example, a system generates two events that get received by logstash with the fol…

Dealing with delays between message receipt and watcher

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Dealing with delays between message receipt and watcher