[TP] Lab: ES|QL alert rule and connector

What you will learn in this TP
Create a connector
Write an ES|QL rule
Trigger and observe the alert

Introduction #

What you will learn in this section
Create a connector
Write an ES|QL rule
Trigger and observe the alert

Context. The team wants to be notified when a host returns too many errors, without watching Discover all the time.

Prerequisites: Lab 1 completed · Estimated time: 40 min

An end-to-end alert in Kibana.

Guided steps, with their solutions.

1. Create an events index
Why? The sample data is frozen in time: a dedicated index lets you inject errors “now”.
Create the lab-web index and inject a few successful requests.
2. Create a connector
Why? The Server log connector writes to the Kibana logs: handy for testing without an external service.
In Stack Management > Connectors, create a Server log connector named “Kibana log” (or a Slack connector if you have a test webhook).
3. Write the rule
Why? ES|QL expresses the threshold and the grouping in a single query.
Create an Elasticsearch query rule in ES|QL mode, checked every minute, that fires when a host has more than 5 errors over 5 minutes. Add an action to the connector.
4. Trigger the alert
Why? Injecting errors tests the whole chain: query, threshold, action.
Inject 10 503 errors on web-2 and wait for the next check.
5. Follow the alert
Why? Kibana keeps the history of alerts and their actions.
Open the rule page: the web-2 alert is active. What happens 5 minutes later, with no new errors?

Difficulty level : ●●●○○ (3/5)

My progress

⏱ Estimated time : ≈ 40 min

No questions yet: be the first to ask for help or share your configuration.