How to create alert monitor where hits is over 100

Hi-
Currently trying to create alert monitor in kibana where alert comes when count of certain object hits 100. For some reason, a single count triggers an alert... I want to make it so that 100 counts of the certain object than triggers an alert.. is it possible to do so? Would I just add count to the equation?

This is my current equation.. Trying to make it when 100 wafs triggers an alert!

image

Help is appreciated! Thanks

Adding below condition after your search request should do that...

    "condition": {
        "compare": {
          "ctx.payload.hits.total": {
            "gte": 100
          }
        }
      }

Thanks,
Sai

Hi Sai,

should i put it after aggregations?

It Should work before/after aggregations, you can try like mentioned below

"condition": {
        "compare": {
          "ctx.payload.hits.total": {
            "gte": 100
          }
        }
      },
"aggregations": {}
}

Thanks,
Sai

Hi Sai,

I tried doing that but its not letting me update.
Did I do this right?

{
"size": 0,
"query": {
    "bool": {
        "filter": [
            {
                "range": {
                    "EdgeEndTimestamp": {
                        "from": "{{period_end}}||-5m",
                        "to": "{{period_end}}",
                        "include_lower": true,
                        "include_upper": true,
                        "format": "epoch_millis",
                        "boost": 1
                    }
                }
            },
            {
                "match_phrase": {
                    "FirewallMatchesActions": {
                        "query": "drop",
                        "slop": 0,
                        "zero_terms_query": "NONE",
                        "boost": 1
                    }
                }
            },
            {
                "match_phrase": {
                    "FirewallMatchesSources": {
                        "query": "waf",
                        "slop": 0,
                        "zero_terms_query": "NONE",
                        "boost": 1
                    }
                }
            }
        ],
        "adjust_pure_negative": true,
        "boost": 1
    }
},
        "condition": {
           "compare": {
           "ctx.payload.hits.total": {
           "gte": 100
      }
    }
  },
"aggregations": {}

}

image

James

James,

My bad, I was assuming the alerting is via watchers where condition can be included in painless script. Am still in 7.6 version and Alerting feature is not available. Sorry for the confusion, do let me know if you find the solution that would help me when we Upgrade.

Thanks,
Sai

BUMP

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.