Hello everyone,
On the Kibana interface I have a rule called "No logs from docker", this is a "Log threshold" rule which should tell me when I have not received a log containing the "event.dataset" with value "docker.container_logs" for more than an hour. I group by "agent.name" to determine which agent is no longer sending me logs.
The rule works, and when I consult it I can see several agents whose alert is "active" and who do not return logs. For some it's normal and so I "mute" them, for others I have to check why they don't send logs, but it's not the object of my current issue.
I configured the alerts to notify me on a "Slack" connector, it works perfectly.
However, I would like to be able to consult these alerts by an API request.
I have already tried a large number of requests. I can indeed see that the rule has active alerts, but impossible to know which alert precisely is active and what it is the agent concerned.
For example, one of my agents on alert is called: "dromao".
I see it as active in alerts when I click on the rule.
But in the response to my API request, there is never anywhere specified "dromao".
Could you please help me to know how to fetch this via API request?
Thank you so much