May 12, 2021
ElastAlert query for special characters.
Since below query has special characters, it fails when try to send an alert and error is logged in elastalert_status*
query: “message:high disk watermark [90%]”
To avoid that give like
query: “message: \”high disk watermark [90%]\””
put-records-elasticsearch.yaml: |-
---
name: put-records-elasticsearch
type: cardinality
limit_execution: "0/10 * * * *"
index: eck-logs
min_cardinality: 50
cardinality_field: "message"
timeframe:
minutes: 15
filter:
- query:
query_string:
query: "message: \"high disk watermark [90%]\""
alert:
- "email"
email:
- "sam@sam.com"
from_addr: "sam@sam.com"
alert_subject: "Logstash is unable to PUT records in Elasticsearch."