Relationship between watches

I wanna do alert in escalation way, for example:

  1. In last 1 minute, my watch found 3 events met the condition, occurs on OBJECT_A. So this watch marked with priority level is 1.
  2. In next firing, my watch found more 3 events occurs on OBJECT_A, same as last watch. <== In here, my alert priority will be in level 2, and send the actual webhook action.

I'm using webhook, so I can solve this by coding the escalation engine in my webhook service, but I want to know how to do this by Elasticsearch and Watcher, is it possible?

Hi @abpabab

It sounds like you can achieve this by checking to see if 3 events met the condition in {now-1m} && 3 events met the condition between {now-2m} and {now-1m} and if it evaluates to true, fire a webhook action.


Ah ha, it's very simple and great.

In the case my watch found multiple OBJECT met the condition. Assume that are the IP addresses, so I need to iterate every IP address to find if I see it between {now-2m} and {now-1m} to generate exactly result.

What my watch looks like and what is the related documents?

Best regards.

I found the example here on watcher example github repo.

Thank your for the support.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.