How to save "total hits" results from a query, in a field

Elastic Stack Logstash
1

Hi, i 'm trying to using Logstash to send email.
I configure the input pipeline filter witha a query, i need to find all the document that contain ERROR in the message.

I do that.
in the output i want to user the total hits value that is contained in the query results, to create a condition : if "total_hits > 10" -> send me the email.

This is the pipeline :

  input {
      elasticsearch {
        hosts => ["https://***********:9200"]
              index => "tibcolog-gpf-*"
              query => '{"query": {"bool": {"filter": [{"bool": {"should": [{"match_phrase": {"logger_type": "ERROR"}}]}},{"range": {"@timestamp": {"format": "strict_date_optional_time","gte": "now-15m","lte": "now"}}}]}}}'
              ssl => true
              ssl_certificate_verification => false
              user => "logstash_writer"
              password => "**********"
              schedule => "*/15 * * * *"
        }
  }

  output {
    if [hits][total] > 10 {
        email {
        to => "********"
        address => "********"
        authentication => "plain"
        subject => "TEST ERROR"
        body => "Il Log in errore è:%{message}"
        port => "25"
        }
        }
    }

My pipeline is on Kubernetes, it is running but it crash (restarting) when the query start .

is i remove the IF condition in the ooutput, it work good.
Somone can tell me how to use the hits for my case??

Thanks

2

Does the field exist? See this thread.

3

No, the field (total hits) does not exist. i thought too that could be the error. But how i can save the total hits to a new field?

I can use a mutate filter with add_field but how can i populate it?
i hoped that there was a way to use the number of total_hits of the query output

4

I have no idea. If the elasticsearch query does not populate that field that I cannot say how you could create it from the event that the elasticsearch input creates.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.