How to create alert monitor where hits is over 100

Elastic Stack Kibana
1

Hi-
Currently trying to create alert monitor in kibana where alert comes when count of certain object hits 100. For some reason, a single count triggers an alert... I want to make it so that 100 counts of the certain object than triggers an alert.. is it possible to do so? Would I just add count to the equation?

This is my current equation.. Trying to make it when 100 wafs triggers an alert!

image

Help is appreciated! Thanks

2

Adding below condition after your search request should do that...

    "condition": {
        "compare": {
          "ctx.payload.hits.total": {
            "gte": 100
          }
        }
      }

Thanks,
Sai

3

Hi Sai,

should i put it after aggregations?

image
image1174×261 6.81 KB

4

It Should work before/after aggregations, you can try like mentioned below

"condition": {
        "compare": {
          "ctx.payload.hits.total": {
            "gte": 100
          }
        }
      },
"aggregations": {}
}

Thanks,
Sai

5

Hi Sai,

I tried doing that but its not letting me update.
Did I do this right?

{
"size": 0,
"query": {
    "bool": {
        "filter": [
            {
                "range": {
                    "EdgeEndTimestamp": {
                        "from": "{{period_end}}||-5m",
                        "to": "{{period_end}}",
                        "include_lower": true,
                        "include_upper": true,
                        "format": "epoch_millis",
                        "boost": 1
                    }
                }
            },
            {
                "match_phrase": {
                    "FirewallMatchesActions": {
                        "query": "drop",
                        "slop": 0,
                        "zero_terms_query": "NONE",
                        "boost": 1
                    }
                }
            },
            {
                "match_phrase": {
                    "FirewallMatchesSources": {
                        "query": "waf",
                        "slop": 0,
                        "zero_terms_query": "NONE",
                        "boost": 1
                    }
                }
            }
        ],
        "adjust_pure_negative": true,
        "boost": 1
    }
},
        "condition": {
           "compare": {
           "ctx.payload.hits.total": {
           "gte": 100
      }
    }
  },
"aggregations": {}

}

image

James

6

James,

My bad, I was assuming the alerting is via watchers where condition can be included in painless script. Am still in 7.6 version and Alerting feature is not available. Sorry for the confusion, do let me know if you find the solution that would help me when we Upgrade.

Thanks,
Sai

7

BUMP

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.