I have a load of data being written to logs that is being ingested by Logstash every minute & pumped into Elasticsearch at which point I am searching and visualizing data within Kibana.
The data in the logs follows this format:
'item_a ':'decrease':-0.01:0.95: 0.96
'item_b ':'increase':0.05:0.55: 0.50
I have logstash ingesting this data with custom fields detailing the name of the item, activity type (increase/decrease), increase/decrease amount, current price, previous price.
I can visualize this quite easily thanks to some help i've received on here. What I want to do is utilise Xpacks Watcher feature, to spot if an item increases or decreases in price quickly, or if say, it increases/decreases 3 times in 5 minutes. If it finds something like this, then I want it to email me.
Been searching high and low for any examples of how this can be done, or if it can be done at all but I'm struggling to find any examples. Can anyone help or would I be better writing a shell script to do this type of calculation and emailing straight from command line?
Any help would be much appreciated.