Alerting on field value change

mohsin106
Fri, 14 Nov 2025 16:56:58 +0000
Logs

I’m currently logging on-change data in ES, and I’m running a latest transform to store the most updated data into a separate index.

I was advised that an ingest pipeline will help me compare any value coming in with the value that is stored in the latest transforms index, and then I can alert when the value has changed.

I have created my ingest pipeline and used the grok processor to pick a field and capture its value, but I don’t know how to compare that value with what is inside the most recent transform index.

Is this possible to do, or should I be taking a different approach?

The goal is to monitor a Boolean field and send an alert every time it changes from true to false.

Thank you.

13 posts - 4 participants