Kibana configure alert based upon dynamic value

Elastic Stack Kibana
,
1

Hello All,
I am new to Kibana, I need to achieve the below. Please advise.

I am using formula to calculate one column data, I want to alert only if the calculated column value is greater than 5% difference.

Example:
Col1 Col2 Col3_Calculated
10 15 50%
20 21 0.5%
.
Here my row1 calculated field (col3_calcualted) field difference is greater than 5%, in such case I need to send an alert once.
Please guide me with the steps

2

You can create a runtime field to store the calculated/difference value and then create a threshold rule to trigger an alert.

3

Thanks Hendry,
Actually I am uploading CSV file into Elasticsearch and building Dashboard based on Kibana.
So where i need to create this runtime field, please let me know in detail

4

You can refer to the doc Map a runtime field | Elasticsearch Guide [8.6] | Elastic.

5

Hendry,
Is it possible for me to do the same in Kibana directly instead of moving to DevTool.
Because all the example shown are using the Devtool and writing JSON, but my requirement is, already I am loading the data from Elasticsearch and in Kibana how can I just create one more calculated field and alert based upon the dynamic value

6

Yes, you can create runtime field in Kibana Data View.

7

Super !
This works...

Could you please let me know how to find difference between current day value and previous day value using runtime field.

shift = '1d' is not working.

8

Time shift function is only available in Lens. What are you trying to do?

9

Please find below detaiks

Requirement 1
I will am having the data in the below way

Col1_Date Col2_val
01-JAN-2023 100
02-JAN-2023 200

I want to find the difference between 100 and 200 and display in a calculated field and if the difference is morethan 5% I need to send an alert.

Requirement 2
I will am having the data in the below way

Col1_Date Col2_Source Col2_val
01-JAN-2023 Source1 100
01-JAN-2023 Source2 200

I want to find the difference between source1 and source2 value for the same date and display in a calculated field and if the difference is morethan 5% I need to send an alert.

10

First of all, you can't use runtime field for this scenario, because you are trying to perform calculation against multiple documents.

The only way you can do this will be to either use Elasticsearch Watcher to periodically perform the calculation and trigger an alert if the condition is met.

Another option will be to use Elasticsearch transform to regularly perform the calculation, store the result in a separate index, and then you can create chart/alerting rule based on the aggregated index.

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.