Permalink
Switch branches/tags
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
28 lines (22 sloc) 853 Bytes

Query Rule

rule {
    //...
    params = [
            "index": "logstash-*",
            "query": [query: [
                                        bool: [
                                            must: [
                                                    ["range": ["@timestamp": ["gt": lastSeenTimestamp]]],
                                                    ["match": [ "message": "error" ]]
                                                ]
                                            ]
                                         ]
                                    ]
    ]

    reaction { messages -> // All messages that match the query
            // Your logic here
    }

}
  • As a query you can use all power of the search API