ELK 8.11 Basic License – Alert if logs with specific field are missing for 30 mins

Elastic Stack Monitoring
1

Hi,

I’m using ELK Stack 8.11.0 (Basic License) and need to trigger an Email or SMS alert if logs with a specific field (example: state:132) are not received for 30 minutes.

Logs normally arrive every few seconds. If no logs arrive for that field within 30 minutes, I want an alert.

Questions:

Can this be done with Basic license Kibana Alerting?

Should I use Index threshold rule or ES query rule?

How to detect missing logs condition?

How to configure Email or SMS alert (via webhook/SMS gateway)?

Thanks!

2

Take a look at ElastAlert 2 - GitHub - jertel/elastalert2: ElastAlert 2 is a continuation of the original yelp/elastalert project. Pull requests are appreciated!

1 Like