Kibana Alert Index Threshold and Log Threshold Host.ip Fields

Elastic Stack Kibana
1

Hi Everyone, i have question regarding Kibana's Alerting feature. As we know, we could use 'Group by' to include field into the alert message. But i have trouble to include host.ip field.

image

Any Suggestion or workaround i can do?
PS: it's the same hostname. that's why i don't use host.hostname.

2

Hi @OmFJ

As you can see here host.ip field is an array. Array fields can't be used for "Group by".

3

Hi @Ersin_Erdal,

Thank you for replying. is there any way i can do to use the IP address ? or is it recommended if i create runtime field from mapping or index template?

Thanks!

4

Hi @OmFJ

Sure, if you have control on your index and know which ip you should use from the host.ip array, you can create new a field out of it and use for grouping.

1 Like
5

Hi @Ersin_Erdal

Thank you so much for the response. I will update this post once i get the result as soon as possible.
Once again, Thank you!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.