I have an alert configured to trigger when the count of a condition reaches a certain value, however I am not receiving any alerts. My query is:
| json "message","logStream","logGroup"
| parse field=message "* * * * * * * * * * * * * *" as version,accountID,interfaceID,src_ip,dest_ip,src_port,dest_port,Protocol,Packets,bytes,StartSample,EndSample,Action,status
| timeslice 1m
| where action="REJECT"
| count as drops by _timeslice
The threshold for my alert is:
Greater than > 1000
This query returns results where the "drops" count is more than 1000, so why am I not receiving my alerts?
The reason you are not receiving any alerts is that when alerting on an aggregated value, even though you receive results > 1000, there is only a single result returned by the query - the alert condition can not determine the value of the result, just the presence or absence, and in this case there will never be more than one row returned per timeslice. For this reason, you want to determine whether your condition is met by using a where clause within your query - in this case:
| where _count > 1000
This will cause there to only be a result if the count is truly greater than 1000, and any single row returned is an indicator that the threshold has been exceeded. You can then set your alert threshold to:
Greater than > 0
This will trigger your alert for any instances of a count greater than, in this case, 1000.