Here i'm trying to check value of scripted value lands between 60 to 30 but i'm not getting hits for that, but i can analyze data in my kibana and i can find matches.
Here is given rule file.
########################################
# Alert if ALB not at latest version #
########################################
# (Required)
# Rule name, must be unique
name: Alert_TLS_Certificate_Expires_In_60_To_30_Days
# (Required)
# Type of alert
type: any
# (Required)
# Index to search, wildcard supported
index: "*"
# All documents must have a timestamp field.
# ElastAlert will try to use @timestamp by default, but this can be changed with the timestamp_field option
timestamp_field: query_timestamp
# (Required, change specific)
query_key: source
# (Required)
# A list of Elasticsearch filters used for find events
# These filters are joined with AND and nested in a filtered query
# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html
filter:
- script:
script:
inline: ((doc['expires_on'].value.millis - new Date().getTime()) /1000/86400) < 60 AND ((doc['expires_on'].value.millis - new Date().getTime()) /1000/86400) > 30
# (Required)
# The alert is use when a match is found
alert:
- command
command: ["scripts/post_new_relic.sh", "--event_type=Alert_TLS_Certificate_Expires_In_30_Days", "--key_value_list=service_id:%(service_id)s,service_environment:%(service_environment)s,source:%(source)s,name:%(name)s"]
in place of
- script:
script:
inline: ((doc['expires_on'].value.millis - new Date().getTime()) /1000/86400) < 60 AND ((doc['expires_on'].value.millis - new Date().getTime()) /1000/86400) > 30
Here i'm trying to check value of scripted value lands between 60 to 30 but i'm not getting hits for that, but i can analyze data in my kibana and i can find matches.
Here is given rule file.
in place of
when i tried
i'm getting hits for this as expected.