Hi In the detections, rules created a custom rule for my own index. A simple match query is not working, but the same rule is working with an aggregate query.! detections|690x283 The rule with custom query externalId: "4625" is not working. But the same rule with threshold query is working. With …

Detections with custom query

Frank_Hassanabad (Frank Hassanabad) October 21, 2020, 5:04pm 2

There's an in-depth explanation of parts fo the threshold rules with regards to fields that are aggregatable vs non-aggretable here that should help you out for trouble shooting issues:

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.