Describe the issue:
I have a monitor for error logs level with multiple index in 1 Cluster, I’m using the “Per query monitor” type with interval of 1 minutes, the query search for “Error” and trigger alarm if there is errors during that 1 minute.
→ The issue is that if during that 1 minute, we have multiple errors, just only 1 alert is generated and push to our team, we want to set up that each error log will trigger an alert for it.
If my understanding is correct, per query type treats the query as a whole unit and evaluates aggregated conditions like ctx.results[0].hits.total.value > 0, even though your query pulls multiple logs, the trigger logic references only the first hit.
If I have n indexes to query like: a*, b*, c*,… n* in my previous per query monitor and I want to change to use per document monitor, I need to create n document monitors, right?
I’m new to Opensearch, could you give me example config of query, trigger and message that use to alert when each time index a* got error log.
Per-query monitors only evaluate the query once per interval, so only one alert is triggered per run. To get alerts for each error, use bucket-level monitors with a grouping field (like message or a unique ID) to trigger individual alerts for each log entry.