Dear,
I'm trying to config an alarm to be sent only when a value from aggregation has a desired or higher value.
e.g. i receive this email, but it must contains only United States and France:
workstation 1 | username 1
- United States (300)
- France (200)
- Irak (99)
- China (20)
My watcher script is:
POST _xpack/watcher/watch/index1-NetbiosConnections/_execute
PUT _xpack/watcher/watch/index1-NetbiosConnections
{
"trigger": {
"schedule": {
"daily" : {
"at" : {
"hour" : 10,
"minute" : 0
}
}
}
},
"input": {
"search": {
"request": {
"indices": [
"winevt-*"
],
"body": {
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"@timestamp": {
"gte": "now-1d"
}
}
},
"should": [
{
"match_phrase": {
"DestinationPortName": "netbios-ns"
}
}
]
}
},
"aggs": {
"group_by_workstation": {
"terms": {
"field": "workstation_name"
},
"aggs": {
"group_by_enduser": {
"terms": {
"field": "enduser.keyword"
}
},
"group_by_countryname": {
"terms": {
"field": "country_name"
}
}
}
}
}
}
}
}
},
"condition": {
"array_compare" : {
"ctx.payload.aggregations.group_by_countryname.buckets" : {
"path": "doc_count",
"gte": {
"value": 100,
"quantifier": "all"
}
}
}
},
"actions": {
"email_me": {
"throttle_period": "1d",
"email": {
"from": "***e-mail address***",
"to": "***e-mail address***",
"subject": "NetBios Connections",
"body": {
"html": "Total events: {{ctx.payload.hits.total}}<br><br><br>{{#ctx.payload.aggregations.group_by_workstation.buckets}} {{key}} | {{#group_by_enduser.buckets}}{{key}}{{/group_by_enduser.buckets}}<br> <ul> {{#group_by_countryname.buckets}}<li>{{key}} ({{doc_count}}){{/group_by_countryname.buckets}}</li></ul>{{/ctx.payload.aggregations.group_by_workstation.buckets}}"
}
}
},
"log_error": {
"logging": {
"text": "Were found {{ctx.payload.hits.total}} events"
}
}
}
}
Thanks!