I have a case where if the application I'm monitoring encounters an error, the error log appears every 3 seconds. I want to create an Elastalert rule which will send alert only for the first match because all others are exact copies EXCEPT for the timestamp in the message. The rule I have currently (below) sends a list of all these error messages.
Slack alert for above rule should have only one error log line even though there are 100s of matches in the 10 minute timeframe because only thing unique about them is the timestamp.
I have a case where if the application I'm monitoring encounters an error, the error log appears every 3 seconds. I want to create an Elastalert rule which will send alert only for the first match because all others are exact copies EXCEPT for the timestamp in the message. The rule I have currently (below) sends a list of all these error messages.
Current Rule:
Desired behavior:
Slack alert for above rule should have only one error log line even though there are 100s of matches in the 10 minute timeframe because only thing unique about them is the timestamp.
How do I go about it? Thank you!