Rule with index connector - issue with {{alert.id}}

Elastic Observability
1

Hello all,

I hope that I write in a good place.

I'm newbie with ELK and I need help with rule.

So I have a rule with index connector, when I add

"alert.id": "{{alert.id}}"

in index in discover logs show me only :

alert.id : "*"

I do not know how can I fix that.

Thanks in advance for any help.

2

Which rule is this?

3

This is alert rule created by me. With index connector.

4

Right, but which rule type? Metric Threshold, Inventory Threshold, Log Threshold, Elasticsearch Query...

5

This is Log threshold

6

Thanks... for the Log Threshold Rule when you set a "group by" field, like host.name, then the alert.id would equal the value of the host.name, like db.foo.com. For Log Threshold rules without a "group by" field, we set the alert.id to * (an asterisk), which represents "everything".

1 Like