Using ELK Xpack Watcher to spot increasing/decreasing prices

alerting

(Luke B) #1

I have a load of data being written to logs that is being ingested by Logstash every minute & pumped into Elasticsearch at which point I am searching and visualizing data within Kibana.

The data in the logs follows this format:

'item_a ':'decrease':-0.01:0.95: 0.96

'item_b ':'increase':0.05:0.55: 0.50

I have logstash ingesting this data with custom fields detailing the name of the item, activity type (increase/decrease), increase/decrease amount, current price, previous price.

I can visualize this quite easily thanks to some help i've received on here. What I want to do is utilise Xpacks Watcher feature, to spot if an item increases or decreases in price quickly, or if say, it increases/decreases 3 times in 5 minutes. If it finds something like this, then I want it to email me.

Been searching high and low for any examples of how this can be done, or if it can be done at all but I'm struggling to find any examples. Can anyone help or would I be better writing a shell script to do this type of calculation and emailing straight from command line?

Any help would be much appreciated.


(Mark Walkom) #2

That sort of trend analysis is exactly what our ML functionality is for.

You may be able to do it with some scripting in a watch though, https://github.com/elastic/examples/tree/master/Alerting may have something you can leverage.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.