Simple Alerting for the ELK Stack

Re:Simple Alerting for the ELK Stack by yahyaheee on Sunday April 24, 2016 @09:05PM (#11562053)

It's a nice product, just be aware that it is purely event driven. So if you are trying to alert on no event then things get messy

[ Parent | on HN ]

Re:Simple Alerting for the ELK Stack by Liuser on Monday April 25, 2016 @03:20PM (#11566609)

Unless I'm misunderstanding your comment, isn't that a flatline type of alert, which is supported by Elastalert?

[ Parent | on HN ]

Re:Simple Alerting for the ELK Stack by yahyaheee on Monday April 25, 2016 @03:29PM (#11566676)

No that is just if a value drops off, but that rule will never fire unless an event occurs in elasticsearch matching that query. I found this out the hard way

[ Parent | on HN ]