Relationship between watches

Elastic Stack Elasticsearch
1

I wanna do alert in escalation way, for example:

  1. In last 1 minute, my watch found 3 events met the condition, occurs on OBJECT_A. So this watch marked with priority level is 1.
  2. In next firing, my watch found more 3 events occurs on OBJECT_A, same as last watch. <== In here, my alert priority will be in level 2, and send the actual webhook action.

I'm using webhook, so I can solve this by coding the escalation engine in my webhook service, but I want to know how to do this by Elasticsearch and Watcher, is it possible?

2

Hi @abpabab

It sounds like you can achieve this by checking to see if 3 events met the condition in {now-1m} && 3 events met the condition between {now-2m} and {now-1m} and if it evaluates to true, fire a webhook action.

Thanks,
Bohyun

3

Ah ha, it's very simple and great.

In the case my watch found multiple OBJECT met the condition. Assume that are the IP addresses, so I need to iterate every IP address to find if I see it between {now-2m} and {now-1m} to generate exactly result.

What my watch looks like and what is the related documents?

Best regards.

4

I found the example here on watcher example github repo.

Thank your for the support.