CODEWITHSUNDEEP
elasticsearchlogstashkibana-4elastic-stacklog-analysis
SivanBH
SivanBH

Reputation: 392

Find Missing Logs with ELK

I've just deployed ELK in an attempt to see if it can be used for monitoring logs and alerting about issues.

What I need to be able to detect is mostly missing records: Say a log record was received, saying a user is about to make some sort of request. I then expect to see the log record saying the request has been made.

If the second record was not received within X seconds from the arrival of the first, then something is wrong, and I want to alert about it.

Any ideas how to achieve that?

Upvotes: 1

Views: 1452

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

I have used the elapsed{} filter to do something similar. With it, you declare the first event and the "matching" event. If the matching event doesn't appear within a period of time, it will generate an "expired event" that you could check for.

Upvotes: 1

Related Questions