There are two fields in each log entry (elasticsearch document), which are userid and ipaddress. I want to fire an alert if the same user logs into the system using 2 or more ipaddresses in the past 10 minutes. So the query should be something like "select count(distinct ipaddress) from index grou…

The important part to understand with regards to watcher is the fact, that most issues are not watcher issues, but the question if you are able to write a query that contains the required information. In this case it is about getting a distinct count. The good news is that you have exactly this fea…

Watcher doesn't support "distinct count"

Elastic Stack Elasticsearch

ahrtr (Ahrtr) February 14, 2018, 7:59am 3

Thanks, sounds good!

Topic		Replies	Views
Create a watcher to check that the IP address of device is same or changing Kibana elastic-stack-alerting	5	676	June 24, 2022
Watcher alert when specific event logged against unique IP Elasticsearch	1	410	December 23, 2019
Watcherで特定のフィールドの値ごとに集計して件数超過で通知する方法日本語による質問・議論はこちら	3	1036	October 12, 2021
Watcher: Usecase: how to find users logging in from different locations using watcher? Elasticsearch elastic-stack-alerting	2	1501	July 6, 2017
Elastic watcher, log multiple fields Elasticsearch elastic-stack-alerting	2	530	October 1, 2020

Watcher doesn't support "distinct count"

Related topics