Help with OpenSearch Monitors

0

I have the following Query for my monitor. It is currently triggering the monitor for any 5+ errors over the span of 10 minutes. I need it to trigger for 5+ errors of 3 unique users over the span of 10 minutes. I dont know why its not accounting for the unique users. Please help me!


{
    "size": 0,
    "query": {
        "bool": {
            "filter": [
                {
                    "range": {
                        "@timestamp": {
                            "from": "{{period_end}}||-10m",
                            "to": "{{period_end}}",
                            "include_lower": true,
                            "include_upper": true,
                            "format": "epoch_millis",
                            "boost": 1
                        }
                    }
                },
                {
                    "match_phrase": {
                        "level": {
                            "query": "ERROR",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                },
                {
                    "match_phrase": {
                        "Properties.featureArea": {
                            "query": "CARD_VIEW",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                },
                {
                    "bool": {
                        "must_not": [
                            {
                                "term": {
                                    "Properties.client_event_id": {
                                        "value": 26,
                                        "boost": 1
                                    }
                                }
                            }
                        ],
                        "adjust_pure_negative": true,
                        "boost": 1
                    }
                },
                {
                    "match_phrase": {
                        "env": {
                            "query": "staging",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "aggregations": {
        "users": {
            "terms": {
                "field": "Properties.userID.keyword",
                "size": 10,
                "min_doc_count": 1,
                "shard_min_doc_count": 0,
                "show_term_doc_count_error": false,
                "order": [
                    {
                        "_count": "desc"
                    },
                    {
                        "_key": "asc"
                    }
                ]
            },
            "aggregations": {
                "error_count": {
                    "value_count": {
                        "field": "level.keyword"
                    }
                },
                "unique_users": {
                    "cardinality": {
                        "field": "Properties.userID.keyword"
                    }
                },
                "user_filter": {
                    "bucket_selector": {
                        "buckets_path": {
                            "errorCount": "error_count",
                            "uniqueUserCount": "unique_users"
                        },
                        "script": {
                            "source": "params.errorCount >= 5 && params.uniqueUserCount >= 3",
                            "lang": "painless"
                        },
                        "gap_policy": "skip"
                    }
                }
            }
        }
    }
}
nikita
asked 3 months ago206 views
No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions