Hi, I am currnetly working on a watcher that send out an alert when a user has too many failed login attempts. I am aggregating the documents first based on the realm then based on the username. Now within the compare clause within my watcher script I want to get the doc_count of the usernames and…

Using a threshold on doc_count within a nested aggregation

system (system) Closed February 4, 2021, 9:06am 6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Array_Compare working with Nested Aggregations Elasticsearch elastic-stack-alerting	4	1327	September 5, 2018
Check some condition for every document in buckets Elasticsearch elastic-stack-alerting	4	491	February 7, 2019
Need to alert if nested aggregation returns more than 3 results Elasticsearch elastic-stack-alerting	1	388	February 4, 2021
Need to extract doc_count value from ctx.payload.aggregations.by_store.buckets_doc_count Kibana	3	408	August 10, 2022
Comparing the last aggregated sub bucket count in the watcher condition Kibana elastic-stack-alerting	2	317	July 27, 2021