How to create an alert for missing value not present in result that its missing in given threshold time

[varunawasthi9]

How can we set an alert, if from a given list of values- 1 value is not present but in a span of 2 sec we get alert?

Eg:

index=abc complete ogid| if ogid is missing from list (abc, xyz)

xyz not received in 2-sec threshold get an alert that xyz didn't receive the orderid.

[woodcock]

Like this:

index=abc complete ogid=*
| stats count BY ogid
| eval which="data"
| inputlookup append=t <lookup file with every ogid listed on a separate line only once, with only one field named 'ogid'>
| eval which=coalesce(which, "lookup")
| stats values(*) AS * dc(which) AS which_count BY ogid
| where which_count==1 AND which="lookup"

[jitendragupta]

You can try like below query. Run this in some cron schedule. If the number of results is greater than zero set an alert.

index=indexname earliest=-2s  | where ogid !=abc or ogid !=xyz