Feasibility to send alerts only if consecutive errors are occurred using elastalert

Elastic Stack Elasticsearch
1

Hi All,

I am trying to setup alerting using elastalert and I am trying to achieve below scenarios.

scenario 1: Send alert if there are 3 consecutive 400 errors. (Which is working fine)

scenario 2: Do not send alert if we get any 200 or success between 3 4xx errors.

Is there any feasibility to do this in elastalert?

2

Elastalert is not supported here so I would recommend reaching out to the Elastalert community or the creators.

3

Hi @Christian_Dahlqvist

Thank you for the reply

Is there any method in elasticsearch to search 3 consecutive 400 errors in specific timeframe without any other 200 responses.

4

Actually, we want to check any method or any way is available to search for the below scenarios in elasticsearch

  1. it's possible to exclude matches for 5 consecutive 500's when it's interrupted by a 200:
No match: 5 5 5 2 5 5
   Match: 2 5 5 5 5 5
   Match: 5 5 5 5 5 5
  1. it's possible to exclude matches for 3 consecutive 400 when it's interrupted by a 200:
No Match: 4 4 2 4
No Match: 2 4 4 2
   Match: 4 4 4
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.