We have an index "Server-Index" where we sometimes get a string indexed with the contents "foo". A few seconds later some other messages will get indexed as well that is tied to the "foo" string above. What we want to do is to trigger if "foo" appears and then aggregate the nextcoming messages that are related to the "foo" string for 5 minutes. Is this possible?
For example:
12:00 we receive a message containing "foo" <- Now we know something bad has happened and in a few seconds we will receive more messages that are related to the first message "foo".
12:01 2 message arrive which contain more information
12:02 4 more messages arrive which contain more information
12:05 we send an alert containing the "foo" string along with all the information provided in the messages receivied thereafter.
Is this possible, if so, what should i be looking at?
while this might be possible with watcher and some advanced queries, I think the functionality you should take a closer look at, are data frames as this allows you to summarize your data, even in a streaming fashion.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.