How can we set an alert, if from a given list of values- 1 value is not present but in a span of 2 sec we get alert?
Eg:
index=abc complete ogid| if ogid is missing from list (abc, xyz)
xyz not received in 2-sec threshold get an alert that xyz didn't receive the orderid.
Like this:
index=abc complete ogid=*
| stats count BY ogid
| eval which="data"
| inputlookup append=t <lookup file with every ogid listed on a separate line only once, with only one field named 'ogid'>
| eval which=coalesce(which, "lookup")
| stats values(*) AS * dc(which) AS which_count BY ogid
| where which_count==1 AND which="lookup"
You can try like below query. Run this in some cron schedule. If the number of results is greater than zero set an alert.
index=indexname earliest=-2s | where ogid !=abc or ogid !=xyz