Elasticsearch queryedit
The Elasticsearch query alert type runs a user-configured Elasticsearch query, compares the number of matches to a configured threshold, and schedules actions to run when the threshold condition is met.
Create the alertedit
Fill in the alert details, then select Elasticsearch query.
Define the conditionsedit
Define properties to detect the condition.
- Index
- This clause requires an index or index pattern and a time field that will be used for the time window.
- Size
- This clause specifies the number of documents to pass to the configured actions when the the threshold condition is met.
- Elasticsearch query
- This clause specifies the ES DSL query to execute. The number of documents that match this query will be evaulated against the threshold condition. Aggregations are not supported at this time.
- Threshold
-
This clause defines a threshold value and a comparison operator (
is above,is above or equals,is below,is below or equals, oris between). The number of documents that match the specified query is compared to this threshold. - Time window
- This clause determines how far back to search for documents, using the time field set in the index clause. Generally this value should be set to a value higher than the check every value in the general alert details, to avoid gaps in detection.
Add action variablesedit
Add an action to run when the alert condition is met. The following variables are specific to the Elasticsearch query alert. You can also specify variables common to all alerts.
-
context.title -
A preconstructed title for the alert. Example:
alert term match alert query matched. -
context.message -
A preconstructed message for the alert. Example:
alert 'term match alert' is active:
- Value: 42
- Conditions Met: count greater than 4 over 5m
- Timestamp: 2020-01-01T00:00:00.000Z -
context.group -
The name of the action group associated with the condition. Example:
query matched. -
context.date -
The date, in ISO format, that the alert met the condition. Example:
2020-01-01T00:00:00.000Z. -
context.value - The value of the alert that met the condition.
-
context.conditions -
A description of the condition. Example:
count greater than 4. -
context.hits -
The most recent ES documents that matched the query. Using the Mustache template array syntax, you can iterate over these hits to get values from the ES documents into your actions.
Test your queryedit
Use the Test query feature to verify that your query DSL is valid.
-
Valid queries are executed against the configured index using the configured time window. The number of documents that match the query will be displayed.
-
An error message is shown if the query is invalid.
