I’m looking for a solution to following problem:
In ELK, I have to create an alert which will trigger - when an error field logged for an index is greater than 80% in last 30 mins The field name is status and it takes info and error as values. I need to get the count of these fields for last 15 minutes and calculate percentage of errors based on that
Count of errors/total counts.