IBM Cloud Private: How to alert on keywords in logs

Question

Does ICP provide alerting on logs or this is something extra? My use case is to alert on critical exception keywords in application logs. ICP's Prometheus alerts deals with metrics/numbers. I am familiar with Graylog which uses ElasticSearch and it provides alerting feature. What is the ICP recommendation for alerting on messages/events in logs?

Answer 1

You can do this with elastalert: https://elastalert.readthedocs.io/en/latest/

https://github.com/Yelp/elastalert https://github.com/bitsensor/yelp-elastalert

Answer 2

If you are looking for ICP supported or inbuilt log alerting then there isn't any. You may have to rely on external tools build upon elastic search as David as pointed out in the answer.