IBM Cloud Private: How to alert on keywords in logs

Question

Does ICP provide alerting on logs or this is something extra? My use case is to alert on critical exception keywords in application logs. ICP's Prometheus alerts deals with metrics/numbers. I am familiar with Graylog which uses ElasticSearch and it provides alerting feature. What is the ICP recommendation for alerting on messages/events in logs?

score 1 · Answer 1 · answered Jun 04 '19 at 21:59

1

You can do this with elastalert: https://elastalert.readthedocs.io/en/latest/

https://github.com/Yelp/elastalert https://github.com/bitsensor/yelp-elastalert

answered Jun 04 '19 at 21:59

David Karlsen

138
2
7

Feel free to mark this as the answer so I can collect my SO karma :) – David Karlsen Jun 05 '19 at 13:19
Hi @David Karlsen - Why can we not use OOB Elastic Rules and Connectors to create an alert for this? There seems to be a special kind of rule (log threshold rule) especially for this - https://www.elastic.co/guide/en/observability/current/logs-threshold-alert.html – Ayushmati Nov 24 '22 at 09:19

score 0 · Answer 2 · answered Jul 24 '19 at 09:08

0

If you are looking for ICP supported or inbuilt log alerting then there isn't any. You may have to rely on external tools build upon elastic search as David as pointed out in the answer.

answered Jul 24 '19 at 09:08

Anand

23
4

Please refer to my comment on David's answer. – Ayushmati Nov 24 '22 at 09:20

IBM Cloud Private: How to alert on keywords in logs

2 Answers2