Kibana alerting: log threshold using OR

[tslattery (Terry Slattery)]

Is it possible to create a log threshold condition that triggers if event.keyword is apConnectionLost OR event.keyword is apConnected? The UI is only allowing the AND operation.
WHEN THE count OF LOG ENTRIES
WITH event.keyword IS apConnectionLost
AND event.keyword IS apConnected <==== Looking for OR
IS more than or equals 1
FOR THE LAST 10 minutes
GROUP BY apName.keyword

Thanks!

[Aaron_Caldwell]

Hello Terry,

You could try an Elasticsearch query alert if the Index threshold alert is too constraining. Here's a link to the docs which primarily focus on the threshold alert, but it all still mostly applies, just substitute the query you want to run for the threshold portions.

Regards,
Aaron