A Spike alert matches when the volume of events during a given time period is larger or smaller based on
spike_height than during the previous time period
This would allow you to receive alerts in scenarios such as if there is 3 times spike up based on a ratio value
spike_height in the number of events matching the
filter query, when compared to the previous time window for events
timeframe. Here is an example below:
name: "Spike example alert"
query: "router.status: [500 TO 599]"
In addition, you can also provide a
threshold_cur value that allows you to configure the minimum number of events that must exist in the current window for an alert to be fired.
Read Logit's introduction to alerting
Learn more about ElastAlert rules: if you'd like to learn more about ElastAlert rules from the people that built it, check out their cheat sheet.