Hi I am trying to create a watch which should alert our Team only when a certain condition matches, For example: "whenever a Failed Login Attempt Detected" RightNow it is sending me an email after each 1 hour with same ctx.paylod.hits.total as no failed login is made and /var/log/secure file has …

You need to change you query to something like this: "query": { "bool": { "must": { "match_phrase" : { "message" : "Failed password for invalid user" } }, "filter": { "range" : { "@timestamp" : { "gte" : "now-1h" } } } } …

addanuj (Anuj Shrivastava) May 6, 2018, 3:47pm 3

Hi Christian,

Thanks for your help...

Please explain or give me an example.

Topic		Replies	Views
Watcher alerts not triggered Elasticsearch elastic-stack-alerting	6	1240	July 31, 2018
How do I setup watcher to only alert on new messages? Elasticsearch elastic-stack-alerting	3	7230	July 6, 2017
Adding watcher condition Elasticsearch elastic-stack-alerting	7	307	April 6, 2023
Elasticsearch watcher syntax Elasticsearch	2	1076	July 26, 2017
Watcher fire once Elasticsearch	5	1079	June 13, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

What should i do to trigger a watch only when condition matches to a certain requirement

Related topics