Responding to changing data with Watcher
From the previous sections, we know how to search for data, aggregate it for analytics, and how to transform documents so that they comply with the desired schema. These capabilities power user-driven data exploration and visualization (using frontend tools such as Kibana). The same capabilities can also be used to provide automated alerting and response actions for your incoming data.
Watcher is a flexible tool that can be used to solve various alerting use cases. The following list describes some of the common alerting use cases:
- Alert on a singular event with a particular value:
a. Alert when event.severity: critical
b. Alert when disk_free < 1GB
- Alert if event count matching a filter exceeds a threshold:
a. Alert if 10 or more events with event.severity: critical have occurred in the last 5 mins.
b. Alert if 5 or more login_failed events per username have occurred in the last 5 mins.
- Alert...
