Help with OpenSearch Monitors

0

I have the following Query for my monitor. It is currently triggering the monitor for any 5+ errors over the span of 10 minutes. I need it to trigger for 5+ errors of 3 unique users over the span of 10 minutes. I dont know why its not accounting for the unique users. Please help me!


{
    "size": 0,
    "query": {
        "bool": {
            "filter": [
                {
                    "range": {
                        "@timestamp": {
                            "from": "{{period_end}}||-10m",
                            "to": "{{period_end}}",
                            "include_lower": true,
                            "include_upper": true,
                            "format": "epoch_millis",
                            "boost": 1
                        }
                    }
                },
                {
                    "match_phrase": {
                        "level": {
                            "query": "ERROR",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                },
                {
                    "match_phrase": {
                        "Properties.featureArea": {
                            "query": "CARD_VIEW",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                },
                {
                    "bool": {
                        "must_not": [
                            {
                                "term": {
                                    "Properties.client_event_id": {
                                        "value": 26,
                                        "boost": 1
                                    }
                                }
                            }
                        ],
                        "adjust_pure_negative": true,
                        "boost": 1
                    }
                },
                {
                    "match_phrase": {
                        "env": {
                            "query": "staging",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "aggregations": {
        "users": {
            "terms": {
                "field": "Properties.userID.keyword",
                "size": 10,
                "min_doc_count": 1,
                "shard_min_doc_count": 0,
                "show_term_doc_count_error": false,
                "order": [
                    {
                        "_count": "desc"
                    },
                    {
                        "_key": "asc"
                    }
                ]
            },
            "aggregations": {
                "error_count": {
                    "value_count": {
                        "field": "level.keyword"
                    }
                },
                "unique_users": {
                    "cardinality": {
                        "field": "Properties.userID.keyword"
                    }
                },
                "user_filter": {
                    "bucket_selector": {
                        "buckets_path": {
                            "errorCount": "error_count",
                            "uniqueUserCount": "unique_users"
                        },
                        "script": {
                            "source": "params.errorCount >= 5 && params.uniqueUserCount >= 3",
                            "lang": "painless"
                        },
                        "gap_policy": "skip"
                    }
                }
            }
        }
    }
}
nikita
gefragt vor 3 Monaten208 Aufrufe
Keine Antworten

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen