Reference Set

Elastic Stack Elasticsearch
1

Hi,

We are using elasticsearch for alerting. Hosts are created and destroyed all the time for development purposes, but we have a core of devices which are tightly controlled. This list of devices is 100+ and are spread across various environments. We would like to alert when a specific event happens on one of these devices.

Does elasticsearch have anything similar to reference sets?

We need to be able to maintain a list of devices (the reference set), then use that in our alerting rule. Eg, if X happens on a device and the hostname is in this reference set

Many thanks.

2

The closest I can think of is Watcher chain input | Elasticsearch Guide [8.5] | Elastic, where you could load the data from the reference index and then iterate over that for your alerts.

Maybe someone else can suggest something else though :slight_smile:

3

Thanks @warkolm

Not exactly what I'm looking for, but I could probably do something with it. :slight_smile:

4

Yeah I get your point :slight_smile:

Another option might be to do this;

  1. store your critical hosts in a new index
  2. enrich your event using an ingest pipeline
  3. tag these critical hosts with something
  4. then use that for alerting