How do I throttle an Elasticsearch Watcher to one alert per event. If an error shows in the logs the watcher will fire until it's acknowledged.
I only want alerts for new errors not a time throttle.
How do I throttle an Elasticsearch Watcher to one alert per event. If an error shows in the logs the watcher will fire until it's acknowledged.
I only want alerts for new errors not a time throttle.
Copyright © 2021 Jogjafile Inc.
I have found found a reasonable solution for this matter here.
I changed the interval of the watcher to
20s
. Then I added a filter for records that are older than25s
.It does only send one notification per record before it leaves that 5 second window. But I have noticed that this is isn't perfect. It does miss a couple of records but for the most part it works to a satisfactory level.
I added this just in case anyone needed it. If there is a better answer please let me know. I hope this helps.