Email notification of mentioned field's data appears x times

[hammadq (Hammad qureshi)]

Hi,

First i am newbie in kibana and elastic search as well, so basically i am using trial version to test if it meets my requirement or not.

I am trying to trigger an email, Current example, i created an index called nocopasa. in that i have field called source and computer name. What i need is if source appears more than 10 times in every 5 mins then send me the computer name of that records through email. I really don't have any idea how can i achieve this.

Let me know if i am not clear to you.

Thanks

[cjcenizal]

Hi Hammad, the tool you'll want to use is Watcher. You can define an input to retrieve data from Elasticsearch. In your case, you'll want to use a date range query to get the occurrence of source in the past 5 mins.

Then you can define a condition, which operates on the results of this query. In your case, you can probably use a compare condition to compare the results and return true if it is greater than 10.

Finally, you will want to define an email action to send yourself an email.

Hope this helps!

CJ