Hi, I have the following watch: { "trigger": { "schedule": { "interval": "5m" } }, "input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "logstash-network-*" ], "rest_total_hits_as_int": true, …

Need to alert if nested aggregation returns more than 3 results

system (system) Closed February 4, 2021, 12:14pm 2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Array_Compare working with Nested Aggregations Elasticsearch elastic-stack-alerting	4	1327	September 5, 2018
Using a threshold on doc_count within a nested aggregation Kibana elastic-stack-alerting	5	718	February 4, 2021
Alerting Conditions and Email Body Elasticsearch elastic-stack-alerting	9	2504	February 12, 2018
Only create an alert when the query gets three hits from the same device Elasticsearch elastic-stack-alerting	4	761	December 30, 2019
Generate alarm only when a condition is applied Elasticsearch elastic-stack-alerting	10	1805	July 7, 2017