Log stoppage alert using Machine learning in ELK 7.12

[jancodenew (jan)]

Hi,

Please help to create a log stoppage alert for critical devices using machine learning.

For example: Index "A" contains 10 Active directory server logs.
Need to generate an email alert if Elasticsearch stop receiving logs from any of the 10 AD servers IPs for last 10minutes.

Thanks in advance.

[richcollier]

Relevant: Creating job: anomaly in the event rate of beats

[jancodenew (jan)]

Hi Thank you @richcollier for sharing the above details.

Still i am not able to create the advanced ml job to alert the low event rate on each AD servers. I have doubt on adding the terms aggregation(hostname) in ml job.

Is there any easier sample example to understand this?

[richcollier]

Can do just a simple multi-metric job, pick the low_count function and pick the hostname as the split field

[jancodenew (jan)]

Thank you @richcollier for the swift response.

Above mentioned multi-metric will help only to detect the low event rate right? what if one of the host stopped sending logs? will this multi-metric detect that?

For example: Index "A" contains 10 Active directory server logs.
Need to generate an email alert if Elasticsearch stop receiving logs from any of the 10 AD server IPs for last 1hour.

Thanks in advance

[richcollier]

A host stopping sending logs IS a "low event rate"