Use multiple filters on multiple indices and multiple rules in same rule file in elastalert


(Kiranmai Reddy) #1

I want to run multiple queries on multiple indices of elasticsearch in elastalert. How can I do that?
example : I want to use the first filter with rule type "any" on index abc* and the second filter with rule type "frequency" on index xyz*

type :any
type:frequency
index: abc*
index: xyz*
filter:

  • match:
    loglevel: "INFO"
    filter:
  • match:
    loglevel: "ERROR"

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.