I use elastalert and want to get an alert at around 1% packet loss.
To test this am forcing a packet loss of 3% on my system using the command:
tc qdisc adddev eth0 root netem loss 3% && sleep 100 && tc qdisc change dev eth0 root netem loss 0.0%
In which beat's field can I see the packet loss? Do I have to use metricbeat or packetbeat?
What field do I have to analyze?