I have a watcher with chained input. 2 searches, each searching for a different process that has been executed within the time period. I have an terms aggregation in each search for host.name
My aim is to trigger an alert of a host.name triggers both processes within the time period.
Am I going about this the right way or is there a better way?
If this is the correct way are there any good examples for the compare of the bucket keys to alert when theres a match for the same host.name in both?