flatline usage

[juaneloxx]

im trying to figure out how to make an alert that would trigger if a certain field doesnt give any results in a set ammount of time So far ive been able to tell when an index is missing but id like to get an alert when a specific field value is missing. Lets say on the index "AD" theres a field user there are 2 users that have to login daily (pedrito and pepito) the idea is to make the alert trigger if pepito has not logged in in at least 24 hours and get a result like "Between timestamp and timestamp2, there were less than 1 pepito events." Thats from an alert i get when an index shows no activity. Ive also been thinking about making individual alert for each field value, but theres too many individual values, so i'd need to make a huge ammount of alerts and thats not the idea. Not sure if this is asking too much, anyway if i make some progress ill be updating this post.

[juaneloxx]

just an example of index missing alert i have

name: "alertname" description: thedescription type: flatline index: the index threshold: 10 timeframe: minutes: 5

filter:

query:
query_string:
query: "little query"

include: ["field"]

alert:

email
post

email:

"mail@mail.x"

smtp_host: "smtphost" smtp_port: port n° smtp_ssl: false smtp_auth_file: "path" from_addr: "mail@mail.x"

http_post_url: "url" http_post_static_payload: orig_query: "qry" alert_name: "Alertname"

(cant get the code format working for some reason) so what it does is that if the entire index shows less than 10 logs in 5 min ill get an alert I want to do something like that but with a specific field not sure if the idea is clear enought, not native english speaker

[juaneloxx]

so an idea i had was something like this

name: "TheName" description: description type: flatline index: index threshold: 10 timeframe: minutes: 5

filter:

• query: query_string: query: 'office:"office1" AND user:(pedro AND pepe AND popo.....)'

include: ["user"]

alert:

• email
• post

email:

• "mail"

smtp_host: "host" smtp_port: port smtp_ssl: false smtp_auth_file: "path" from_addr: "mail"

http_post_url: "url" http_post_static_payload: orig_query: 'office:"office1" AND user:(pedro AND pepe AND popo.....)' alert_name: "TheName"

index name and field name are not the real ones

So the thing with that alert is that it would trigger if any of the mentioned users shows no activity but i wont know who specifically is the one not showing activity, ill just know one of them is not showing activity.