Thanks for responding. The watcher runs every 5 minutes and it checks the cron log for the prior 10 minutes. The cron job runs every 5 minutes. I had an alert sent at 2:07 today. The cron ran at 2 pm and 2:05. I checked the Logs interface in kibana. The entry has a timestamp of:
2020-06-30T18:05:09.001Z .
It does not appear to be an ingest issue . How can I confirm it check all log records for the last ten minutes?
If the timestamp is the timestamp when the event has happened on the original system (like a log entry being generated), you don't have any guarantee that this event has been ingested within any timeframe (i.e. using an ingestion timestamp via a pipeline).
I am still not sure you ruled my above scenario out, but happy to be corrected!
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.