I have two types of events in the same index:
2016-10-27 00:43:49.722 event=file_change
2016-10-27 00:43:54.000 event=git_commit
I need to alert specifically when event=git_commit does NOT occur within 5 minutes of event=file_change
It seems that there are a few ways to go about this, using join or append or transaction - but given that my end goal is just an alert that one event exists without the other, I'm not sure which is the best search command to go with, given that I need a "if this and NOT that, alert". Any suggestions welcome!
I'd use transaction
...|transaction event startswith="file_change" max_span=5m|search eventcount=1
that should give you any transaction that only has a file_change with no git_commit within 5 minutes.
Give this a try
your base search | transaction startswith=event="file_change" endswith=event="git_commit" | where duration>300
I'd use transaction
...|transaction event startswith="file_change" max_span=5m|search eventcount=1
that should give you any transaction that only has a file_change with no git_commit within 5 minutes.