How to create an alert the log fields based on the percentage of failures?



  • Official comment
    Matt Sullivan

    sorry for delay. this might be a good use case for a subquery. the child query could determine whether or not you care to see the raw messages in that same 10m timewindow. if you don't need the raw messages include a random keyword in the parent query so it returns zero results.

    I included a few other optimizations, since (a) you can put the json parsing into one code line, (b) don't need field=_raw, and (c) I don't see that you wound up using the lower field.

    net net this is what I came up with:

    [subquery: _sourceName=xxx | json "response_time", "request_id" as response_time, request_id
    | if (num(response_time) > 100, 1, 0) as higher
    | count as total_requests, sum(higher) as response_time_greater_than_100
    | (response_time_greater_than_100/total_requests) as failure_ratio
    | if (failure_ratio > 0.05, " ", "hacknonexistentkeyword") as kw
    | compose kw keywords]
    | json "response_time", "request_id" as response_time
    | where (num(response_time) > 100)

  • Avatar
    Ramakrishna Hande


    Thanks for the reply. I had already used the subqueries and solved it. 




Please sign in to leave a comment.