We are attempting to make a Log Threshold alert, however it is sending alerts when it shouldn't be. The query we are trying to alert on is labels.application: "theapp" and message: "*limit request headers fields size*". Inside the log threshold alert we have:
WHEN more than or equals 1 log entry
WITH labels.application IS theapp
AND message MATCHES PHRASE limit request headers fields size
FOR THE LAST 10 minutes
Sorry to hear you're having problems with log alerts.
The documentation for log alerts exist here, however they are limited at the moment. We are due to expand these soon.
The MATCHES PHRASE comparator uses a match phrase query for querying data.
It looks like you want to use a wildcard query instead, unfortunately this isn't supported yet, but we do have a ticket for it. I can't guarantee when it will be placed on the roadmap, but it's becoming a highly requested feature.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.