How to exploit rules

[georgii (Georgii Gorbachev)]

@Iroshu It turns out there's a recent thread where another user had a similar question about reindexing alerts into a separate index.

Creating Multiple Alert Documents when Alert is Triggered

Hi all, I've got a bit of a unique issue. For the system I am developing, data records will be ingested and compared against thresholds to confirm if values are anomalous. To test out this functionality I've set up an alert that applies a range query to check if a value is acceptable or not. I've set up an index connector, so that when the alert is triggered, a document is written to a specific index. The issue I've encountered is that we require one alert document to match up to each docume…

In that thread, it was suggested that for the time being, the best workaround would be leveraging Logstash pipelines for reindexing alerts elsewhere. Related documentation:

• Creating a Logstash pipeline | Logstash Reference [8.11] | Elastic
• Elasticsearch input plugin | Logstash Reference [8.11] | Elastic