A Percentage Match alert matches when the percentage of documents within a
match_bucket_filter within a calculation window (by default
buffer_time) is higher or lower than a relative percentage value
This would allow you to receive alerts in scenarios such as If there is a 20% increase
max_percentage in the number of 500 errors
match_bucket_filter within a 15 minutes timeframe
buffer_time you would receive an alert to your configured channel. Here is an example below:
name: "Percentage match example"
query: "router.status: [500 TO 599]"
In addition, you can also provide a
filter query to limit the initial results that the match_bucket_filter will be applied to.
Read Logit's introduction to alerting
Learn more about ElastAlert rules: if you'd like to learn more about ElastAlert rules from the people that built it, check out their cheat sheet.