and the value I'm looking for is: "size_in_bytes": 2205540490
But I could not find how to create an alert based on this value...
I looked at the "index threshold" type of alerts: Index threshold | Kibana Guide [master] | Elastic - and while I am able to specify the index pattern (.ds-elastic-cloud-logs*) in the rule - the "size-in-bytes" field is not available for use in the alert...
Also looked at the "elasticsearch query" type of alerts: Elasticsearch query | Kibana Guide [master] | Elastic - but I can only get a count of documents returned by a query to be used as the metric, not the size of indices ...
Any other way to achieve what I want?
Thank you!
Marina
Have you tried to create a pipeline that gets information from the _stats API and saves it in another index? In this other index that will make the storage summary, you can create an alert for the desired field. Another possibility, if applicable to your scenario, is the use of ILM to manage your index storage and perform the rollup. ILM: Manage the index lifecycle | Elasticsearch Guide [8.7] | Elastic
Thank you, @grfneto ! I was looking for something out of the box for Alerts - will keep this option in mind too. And I do use ILM - but wanted to add alerts as a precaution as well.
Thank you, @vincenbr ! I was hoping to have an out-of-the-box option like that for Alerts - will keep the Watch approach in mind - although as I checked the GIT repo example - it does look quite intimidating
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.