Hi I am trying to create a watch which should alert our Team only when a certain condition matches, For example: "whenever a Failed Login Attempt Detected" RightNow it is sending me an email after each 1 hour with same ctx.paylod.hits.total as no failed login is made and /var/log/secure file has …

You need to change you query to something like this: "query": { "bool": { "must": { "match_phrase" : { "message" : "Failed password for invalid user" } }, "filter": { "range" : { "@timestamp" : { "gte" : "now-1h" } } } } …

What should i do to trigger a watch only when condition matches to a certain requirement

Elastic Stack Elasticsearch

system (system) Closed June 6, 2018, 7:23pm 8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
How do I setup watcher to only alert on new messages? Elasticsearch elastic-stack-alerting	3	7200	July 6, 2017
Watcher alerts not triggered Elasticsearch elastic-stack-alerting	6	1232	July 31, 2018
Elasticsearch watcher syntax Elasticsearch	2	1072	July 26, 2017
Watcher search for feild value in last 1mins Elasticsearch elastic-stack-alerting	2	1068	July 6, 2017
Watcher fire once Elasticsearch	5	1063	June 13, 2017

What should i do to trigger a watch only when condition matches to a certain requirement

Related topics