How to show fild's contain throught connector log

Elastic Stack Kibana
, ,
1

Hello there!

I'm working on an alerting system.
I use Kibana connector log and Logstash to sand emails.

For now I have rule to show just a count of files, but I would like to see the contain of field.

For example, I have fields 'state' and 'filename'. My rule has filter by 'state' field when it is with 'error'. But it shows only the count ( like 5 errors for last 10 minutes).
I want to see contain of 'filename' field (when it is in error state).

Is there some options in Kibana to do that?

Thank you for any answers!

2

Hello @Dariia_Hrebenichenko

Welcome to the community.

This will return all the values of filename as per the records which qualify your rule

{
  "filename": "{{#context.hits}} {{_source.filename}} {{/context.hits}}"
}

If you just want to display the first value :


{
  "filename": "{{context.hits.0._source.filename}}"
}

Thanks!!

3

Yes, thank you!

Also needed to use a good type of rule for that.