Throttle Elasticsearch Watcher to one alert

978 Views Asked by At

How do I throttle an Elasticsearch Watcher to one alert per event. If an error shows in the logs the watcher will fire until it's acknowledged.

I only want alerts for new errors not a time throttle.

1

There are 1 best solutions below

0
On

I have found found a reasonable solution for this matter here.

I changed the interval of the watcher to 20s. Then I added a filter for records that are older than 25s.

It does only send one notification per record before it leaves that 5 second window. But I have noticed that this is isn't perfect. It does miss a couple of records but for the most part it works to a satisfactory level.

I added this just in case anyone needed it. If there is a better answer please let me know. I hope this helps.