I have the following search queries:
API Error Alert
---------------
index=myindex sourcetype=my-app:app |spath message | regex message="^.*Error while creating account.*$" |dedup my_id_field
API Down Alert
---------------
index=myindex sourcetype=my-app:app | spath message | regex message="^.*api-down.*$" | dedup my_id_field
Update API Error
------------------
index=myindex sourcetype=my-app:app | spath message | regex message="^.*Error while updating trial account.*$" | dedup my_id_field
I have some more of the same kind. It is checking against multiple messages using. regular expressions. Now I would like to create an email alert for all these events and would like combine all these into one query and so I can create a single alert rather than creating individual alerts. How can I combine these queries ? It should trigger the email alert if any of these conditions is true. I have tried the following, but it is not working.
index=myindex sourcetype=my-app:app |spath message | regex message="^.*Error while creating account.*$" | regex message="^.*api-down.*$"|regex message="^.*Error while updating trial account.*$" |regex message="^.*JWT Token creation failed with error.*$" |regex message="^.*Error while fetching IPLookU.*$"
index=myindex sourcetype=my-app:app |spath message | regex message="Error while creating account|api-down|Error while updating trial account|JWT Token creation failed with error|Error while fetching IPLookU"
Use where clause rather than regex
index=myindex sourcetype=my-app:app
| spath message
| where match(message, "^.*Error while creating account.*$") OR
match(message, "^.*api-down.*$") OR
match(message, "^.*Error while updating trial account.*$") OR
match(message, "^.*JWT Token creation failed with error.*$") OR
match(message, "^.*Error while fetching IPLookU.*$")