Match multiple searchs in single watcher

alerting

(Chaitra Ranganna) #1

Hi
I have requirement where I need to match multiple patterns from the same the index and raise a alert for each pattern.

For example Index "test*" contains below data for field text

text: cluster is unavailable or misconfigured
text: cannot process template resource

Should I write separate watcher to handle the above two patterns or can I accommodate multiple search in single watcher?


(rich collier) #2

Hi - this is best accomplished with a chained input. A recent discussion on this topic is here.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.