When the query ends with stats count, it will always return one result. Therefore, Number of Results > 0 will always trigger the alert. Add a where command to the alert so it only returns results if there are consecutive errors. index=your_logs "error"
| bin _time span=1m
| stats count as error_count by _time
| streamstats window=2 current=t count(error_count) as consecutive_error_minutes
| where consecutive_error_minutes >= 2
| stats count as alert_trigger
| where alert_trigger > 0 That said, I have doubts about the methodology used. The current query will trigger if two consecutive errors are detected, but what if they're different errors? Does it matter? I would think that two different errors would not be considered "persistence".
... View more
