Use multiple filters on multiple indices and multiple rules in same rule file in elastalert

Elastic Stack Elasticsearch
1

I want to run multiple queries on multiple indices of elasticsearch in elastalert. How can I do that?
example : I want to use the first filter with rule type "any" on index abc* and the second filter with rule type "frequency" on index xyz*

type :any
type:frequency
index: abc*
index: xyz*
filter:

  • match:
    loglevel: "INFO"
    filter:
    - match:
    loglevel: "ERROR"
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.