Reference Set


We are using elasticsearch for alerting. Hosts are created and destroyed all the time for development purposes, but we have a core of devices which are tightly controlled. This list of devices is 100+ and are spread across various environments. We would like to alert when a specific event happens on one of these devices.

Does elasticsearch have anything similar to reference sets?

We need to be able to maintain a list of devices (the reference set), then use that in our alerting rule. Eg, if X happens on a device and the hostname is in this reference set

Many thanks.

The closest I can think of is Watcher chain input | Elasticsearch Guide [8.5] | Elastic, where you could load the data from the reference index and then iterate over that for your alerts.

Maybe someone else can suggest something else though :slight_smile:

Thanks @warkolm

Not exactly what I'm looking for, but I could probably do something with it. :slight_smile:

Yeah I get your point :slight_smile:

Another option might be to do this;

  1. store your critical hosts in a new index
  2. enrich your event using an ingest pipeline
  3. tag these critical hosts with something
  4. then use that for alerting

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.