I want to generate an alert whenever a pod is restarted in kubernetes. I am planning to use kubernetes.container.status.restarts to identify whether pods are restarted or not. I would like to have a single elasticsearch query and generate multiple alerts one per pod per namespace which is restarted. I know this is a fairly standard requirement, but couldn't find any elasticsearch query examples. I tried the following query for a specific pod, but I am unable to generate individual alerts, but only a single alert. Can you please help ? Here is my elasticsearch alert query:
Thank you. I tried your suggestion. However, I am not getting multiple alerts, but only a single alert. Can you let me know if there is any issue in my elastic altert ? Here is a screenshot for your reference
Thank you for your response. The reason I chose to use query is because with metric threshold, I was unable to get pod that restarted, the namespace etc. Will try it out and get back if I have further questions
I got the pod name by grouping over both namespace and pod name. However, let me know if there is a way to get a link to the query results which I can use to get more details about the event. Appreciate your help.
I have one more small issue. I am creating the rule using the following query using Kibana REST API. The query get's created successfully, however the query behaves like kuberntes.container.name: * instead of filtering out the containers that I am interested. I have included a snippet of my parameters for your reference.
However, if I go to Kibana UI and then save the query again, it starts working. The difference I see is that after I save the rule, it converts the filterQueryText to an actual query and saves it in "filterQuery" field. Can you let me know why using filterQueryText doesn't work ?