Kibana - APM Alerting

[ndiepray]

Describe the feature:
There is no rule that can check the error message in the current apm alert rules.

Describe a specific use case for the feature:
I hope there is an apm alert rule that can check the error message as below.

Or, it would be nice if you could also check the error message in the error count rule.

[elasticmachine]

Pinging @elastic/apm-ui (Team:APM)

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[gbamparop]

Hi @ndiepray, thank you for opening this. We have recently added a filter for the error grouping key in the error count threshold rule in 8.8 (PR). Does this cover your use case?

[ndiepray]

Hi @gbamparop. Thanks for the answer, but could it be possible to add a filter for error messages?

[gbamparop]

@ndiepray filtering by error messages is not possible at the moment but we will be looking into adding more filters in the future, possibly with a KQL filter bar.

In the meantime, if grouping keys work for you, you can get them from the error documents or the errors details page.

[kpatticha]

@ndiepray

the error grouping key is used for grouping multiple instances of similar errors, using a hash of the error message and other properties. You can find the details in the algorithm here

In the example below you can see 3 out of the 1000 errors that are grouped by the key fce47 and they are very similar.

Screen.Recording.2023-07-17.at.10.39.43.mov

Setting the error.grouping_key filter allows you to get notifications for similar errors.