Log threshold rules does not allow filtering with boolean fields

[qatium-developers]

Hello,

we are trying to generate a Log Threshold rule that requires checking a boolean field to detect if the alert must be raised or not, but UI interface does not allow to use this kind of fields.

We have checked the documentation and it does not mention anything related to this.

Here is a screen capture of the rule form:

And here is the field in the index:

As a workaround we are planning to remap that field to a text/keyword field type, but we want to know if there is another workaround or if it is a bug or a planned feature.

Thanks in advance.

[stephenb (Stephen Brown)]

Perhaps try an Elasticsearch Query Rule

[qatium-developers]

Thanks, we will try and post here an update.

[qatium-developers]

@stephenb Thanks, we are able to use boolean field types using Elasticseach query based rules, although generating it is far more complex than using Log Threshold rules.

Do you know if there is a plan to include those field types in Log Threshold rules?