Watcher Alert Conditions

Elastic Stack Kibana
1

Hey guys,

I was wondering if it's possible to run a watcher alert based on conditions where tags are used. For example, I would like to alert by slack when:

  • count of tags "root_log_error" OR "sys_mon_error" greater than 5 over the last 15 min;

I don't think I can do this with the simple watcher. Maybe with the Advanced Watcher?

Thanks!!
Any help is appreciated!!

2

It is not possible with the simple watcher since there is not way to include a filter in the watch.

You should be able to do this with the advanced watcher since you can set input.search.request.body and specify the query there