How to write the alarm rules I need？
netkey opened this issue · 1 comments
netkey commented
I need to implement an alert, but found that none of the existing rule types seem to meet my needs. My needs are as follows:
Index: client-log-*
Query filter: index.keyword:"client-android" AND client.b_data.eventId.keyword:"9900013"
Alarm triggering condition: When the value of the total number of records satisfying the above query rules/the unique count of app.useriden.keyword is greater than 100, the alarm will be triggered. The formula is: count()/unique_count(app.useriden.keyword)>100
How should I write this rule?
netkey commented
sorry,elastalert is not maintained. Please use elastalert2.