I would like to create a single alert for all HTTP error codes in events.
Ex: I would like to create an alert for 400,404,500 etc error codes if the count reaches 25 in 5 mins period for 2 error codes and if the count reaches 250 for other error code. Do I need to create an alert for each error code, or is there a way we can include everything in single alert?
Would really appreciate if anyone can help.
Like this (for a single alert/search):
... (errorCode=400 OR errorCode=404 OR errorCode=500) | bucket _time span=5 | stats count by errorCode _time | where (count<25 AND (errorCode=400 OR errorCode=404)) OR (count<250)
Ok.One more question is , Is there a way to include the message in the alert description we which error code has exceeded the threshold?
Ex: we have the alert name as "Httperror alert" - but its just sending an alert with number of events (31).
So , we are not sure which error code exceeded,as we have 2 error codes has same threshold.
In your "Save as Alert" dialog, in the "Send email" section, there are some options under "Include." Click the "Inline" option (4th one in that section) and leave the little drop-down next to it set to "table".
That will create a little table of the results of the search that triggered the alert, and include it in the email it sends, so you can see the data itself.