It only takes a few minutes to add an ElastAlert server to any of your Logit ELK stacks. Once enabled, you'll be able to edit and setup alerting rules for all your stacks.

If you don't yet have a Logit account, sign up on the Logit homepage and create your account.

Here's how the 14 day free trial works:

  1. You can create up to 3 production ready ELK stacks in a trial.
  2. All free for 14 days, no credit card required.
  3. After your free trial ends, Logit.io products start at $49 per month.

Provision your ElastAlert server

When you login your stacks are displayed on the dashboard. To enable alerts for a stack, choose the settings button.

Next, choose Alerts and then click Provision ElastAlert for this stack 

Then create your ElastAlert rule

Use the code block below to quickly get started with your email alert.

name: Production App Errors

type: any

# (Required)
# Index to search, wildcard supported

index: logstash-*

## Receive an alert for every single match

realert:
  minutes: 0

# (Required)
# A list of elasticsearch filters used for find events
# These filters are joined with AND and nested in a filtered query

filter:
- query:
    query_string:
      query: "type: error"

# (Required)
# The alert used when a match is found
alert:
- "email"

# (required, email specific)
# a list of email addresses to send alerts to

email:

- "me@logit.io"

How to use the code

  1. Paste the code into the alert replacing any existing rule.
  2. Then just edit the code to match the filter query you need, in this case we are looking for matches on "type:error".
  3. Replace me@logit.io with the required email address.
  4. Choose test to run the rule against your data over the last 24hrs.
  5. Once happy, choose update to apply and save the rule.

Now you're all set to send email alerts from Logit.

What's next?

  • Learn more about ElastAlert rules: if you'd like to learn more about ElastAlert rules from the people that built it, check out their cheat sheet.
  • Learn how to send alerts to Slack from your Logit stacks.
Did this answer your question?