Kibana rules and group by

Elastic Stack Kibana
1

Hi all,
I am trying to create a rule/alert.
The rule is working as inteded, but the mail notification is causing my troubles.
Hopefully someone smarter than me can point me in the right direction.
I am using the UI to create it, and to avoid posting pictures i will "handwrite my steps, in hopes that someone can guide me.
It is a Log Threshold type rule.

WHEN THE count OG LOG ENTRIES
WITH data.cloudResources.resource.type MATCHES "USER_INVITATION"
AND data.request.data.user.email.keyword IS NOT " "@email.com
IS more than 1
FOR THE LAST 1 day
GROUP BY data.request.data.user.email.keyword

the email connector message section looks like this:

{{^context.isRatio}}{{#context.group}}{{context.group}} - {{/context.group}} Was
invited into MyConfluent Cloud{{/context.isRatio}}

And it give me a mail saying that whatever user is invited in to MyConfluent Cloud.
However, i would like the mail to also contain the user who invited the new user.
The user performing the invite in found in this field data.request.data.user.email.keyword
But if i add that field to the group by section, it just send an email with the values of the 2 fields separated by a comma.

How can i format the mail body in a way that it says something like userA has invited userB into MyConfluent Cloud?

Best regards
Oelsner

2

The behavior for expanding array values in mustache is just that - it returns the elements of the array, separated by a comma.

Though I guess it's not documented, apparently you can access array elements as if they were numeric property names; so data.request.data.user.email.keyword.0 would expand to the first array element. At least according to this issue: Accessing Array item by index in template · Issue #158 · janl/mustache.js · GitHub

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.