Number of alert in given time with particular key

[dSohaliya]

Hi,
In my usecase I need total number of alerts that had particular key value pair in every i day period.
I couldn't found any rule for this such usecase.

If we have any rule please tell me, otherwise we can add a rule for this usecase which return total count in given period. It could be useful.

[jertel]

Hello,

You stated: "I need total number of alerts". That tells me you are wanting ElastAlert 2 to monitor its own alerts that it triggers, and then send out additional alerts summarizing it's daily alerts. Is this correct?

[dSohaliya]

not exactly, What I want is to get total number of error count which can be found by a log level field in document, and send me the alert for total count of ERROR logs for the entire day to next day.

[jertel]

You could try a rule type that supports use_count_query will allow you to just return the count of matches rather than each matching error event. Or use an aggregation rule. Then use a limit_execution setting to only run the check at the day boundary time of your choosing. Your buffer_time, timeframe, and run_every settings will likely need to be adjusted for a full day. The docs cover these settings.

[nsano-rururu]

https://elastalert2.readthedocs.io/en/latest/ruletypes.html#rule-types
https://github.com/jertel/elastalert2/tree/master/examples/rules