Logstash-* in Alert/Action section

Elastic Stack Logstash
1

Hi

I used rsyslog to send log to ELK, like this guide How To Centralize Logs with Rsyslog, Logstash, and Elasticsearch on Ubuntu 14.04 | Elastic

Then I used grok to pars log's messages in logstash.conf

Now I want to create Alert, but I can't used logstash-* index in "Log threshold" filter.

What should I do?

2

It is necessary to mention i can use this filter in discovery section

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.