All Collections
Logs Management
Configure Frequency Alerts for OpenSearch
Configure Frequency Alerts for OpenSearch

Create a frequency alert for logs/metrics. When log count exceeds a certain number of events within a time interval, trigger an alert

Kieran Southern avatar
Written by Kieran Southern
Updated over a week ago

A Frequency alert matches when there are at least a certain number of events num_events in a given timeframe timeframe.

This would allow you to receive alerts in scenarios such as if there are 100 or more events num_events matching the specified filter query and the events all happen within a 3-hour window timeframe you would receive an alert to your configured channel. Here is an example below:

name: "Frequency alert example"
type: frequency
index: "*-*"

hours: 3

num_events: 100

- query:
query: "router.status: [500 TO 599]"

minutes: 10

hours: 8

- "email"

- ""

Additional Options

In addition, you can also provide a realert to ignore repeating alerts for the defined period of time. You can also provide an exponential_realert value and this will exponentially increase the value realert while alerts continue to fire.

What's next?

Did this answer your question?