Hi Everyone, i have question regarding Kibana's Alerting feature. As we know, we could use 'Group by' to include field into the alert message. But i have trouble to include host.ip field.
Any Suggestion or workaround i can do?
PS: it's the same hostname. that's why i don't use host.hostname.
As you can see here host.ip field is an array. Array fields can't be used for "Group by".
Thank you for replying. is there any way i can do to use the IP address ? or is it recommended if i create runtime field from mapping or index template?
Sure, if you have control on your index and know which ip you should use from the host.ip array, you can create new a field out of it and use for grouping.
Thank you so much for the response. I will update this post once i get the result as soon as possible.
Once again, Thank you!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.