Mustache template aggregate, group by

I went through the following topic:

I also need to aggregate the result.

I can create the message output using the following:

triggered Alert for Host: {{}} with Severity: {{ctx.trigger.severity}} for log level *{{_source.log.level}} event_id: {{_source.winlog.event_id}}

But how can i aggregate the alert message output by host and the number/total count of event_id using the query response?

Desired Output:

  • Trigger: Test Trigger if Event_id count >= 1
  • Severity: 1
  • Period start: 2019-09-3T12:35:53Z
  • Period end: 2019-09-3T12:36:53Z

Unhealthy Nodes:
Hostname: computer01, Event_id: 8194, Event_Count: 3
Hostname: computer02, Event_id: 8194 , Event_Count: 10

I have the following Query response

“_shards”: {
“total”: 25,
“failed”: 0,
“successful”: 25,
“skipped”: 0
“hits”: {
“hits”: [
“_index”: “winlogbeat-7.1.1-2019.09.03”,
“_type”: “_doc”,
“_source”: {
“agent”: {
“hostname”: “computer01”,
“id”: “c2be2732-0605-44c4-8f6e-759f4bf29eef”,
“type”: “winlogbeat”,
“ephemeral_id”: “26f85118-668f-4fdd-9bfa-90613af50842”,
“version”: “7.1.1”
@timestamp”: “2019-09-03T11:03:45.558Z”,
“winlog”: {
“record_id”: 427038,
“computer_name”: “”,
“event_id”: 8194,
“task”: “”,
“keywords”: [
“channel”: “Application”,
“api”: “wineventlog”,
“event_data”: {
“Binary”: “2D20436F64653A20575254575254494330303030313238372D2043616C6C3230”,
“param1”: “0x80070005, Access is denied.”,
“param2”: “\n\nOperation:\n Gathering Writer Data\n\nContext:\n Writer Class Id: {e8132975}\n Writer Name: System Writer\n Writer Instance ID: {c9162cad-961f}”
“opcode”: “Info”,
“provider_name”: “VSS”
“ecs”: {
“version”: “1.0.0”
“log”: {
“level”: “error”
“host”: {
“hostname”: “computer01”,
“os”: {
“build”: “17134.885”,
“kernel”: “10.0.17134.885 (WinBuild.160101.0800)”,
“name”: “Windows 10 Enterprise”,
“family”: “windows”,
“version”: “10.0”,
“platform”: “windows”
“name”: “computer01”,
“id”: “81ad8be0-e195-4449-a1ff-94aac008d060”,
“architecture”: “x86_64”
“event”: {
“code”: 8194,
“created”: “2019-09-03T11:03:45.616Z”,
“kind”: “event”
“message”: “Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback }”
“_id”: “L-rL9mwBaGHd-dxVe1hT”,
“sort”: [
“_score”: null

Currently following is the output

I have mostly the same problem: the same alert must be fired for each host that triggers it.

Lucas is engaged here on this topic with me, you can comment if you like.