Hello, I have recently built a few alerts in Kibana (7.1.1). The alerts that I have using the extraction method is to query a specific value in the field : CustomerEndpoint address.
I am trying to understand, if I had to add 2 values in the Endpoint address, how will I do so?
Should I be using array/ OR operator?
- Under the action items in trigger > there is a box for message preview , how can I add the some fields from _source in that message?