How to check if a keyword exists in elastalert

Elastic Stack Elasticsearch
1

I wanted to send out an alert to our slack channel if a there is an indexing error or the number of events > 20 for last 10 minutes. Below is my elastalert yaml configuration.

influx_indexing_error_slack_message_rule: |-
    ---
    es_host: elk.org.my.com
    es_port: 9200 
    name: failure message
    index: logstash-influxdb*
    type: frequency
    num_events: 20
    timeframe:
      minutes: 10
    realert:
      minutes: 15
    filter:
    - exists:
        field: "error.keyword"
    alert:
    - "slack"
       slack related detail

image

Will this work real time ? I don't see much of a documentation covering the exists conditions, hence reached out to you experts here.

I went thru - Writing Filters For Rules — ElastAlert 0.0.1 documentation

2

Hi @Chel_Db

Elastalert is not part of the Elastic Stack so you really need to go to their forums to ask questions... We are not experts on that.

If you have questions on the built in Alerting framework we are happy to help with that! :slight_smile:

3

My bad, thanks @stephenb . I will reach out to them.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.