Hi everyone, I'm having some issues with my Disk Usage rule, more specifically with the document to index part.
Some of my fields come out as empty.
This is my current 'Document to index':
{
"doc_type": "alert",
"@timestamp": "{{date}}",
"top_hit": "{{context.hits}}",
"context_conditions": "{{context.conditions}}",
"context_message": "{{context.internalShortMessage}}",
"context_title": "{{context.title}}",
"context_value": "{{context.value}}",
"rule_name": "{{rule.name}}"
}
And when I query this index I get this output:
[{'_index': '<index>',
'_id': '<id>',
'_score': 0.0,
'_source': {'doc_type': 'alert',
'@timestamp': '2024-07-02T09:09:08.049Z',
'top_hit': '',
'context_conditions': '',
'context_message': 'Disk usage alert is firing for node <node> in cluster: <cluster>. Verify disk usage level of node.',
'context_title': '',
'context_value': '',
'rule_name': 'Disk Usage'}},
As you can see some fields come out as empty, and I can't figure out why. I'm still quite a begginer at ELK so I'm sorry if this is a dumb question.