I am using an elasticsearch and kibana opendistro images of version 1.13.1.
I have 4 CPEs [CPE01, CPE02, CPE03, CPE04] and connected 4 interfaces [ETH00, ETH01, LAN00, LAN01] for each CPE’s. I had downed one of the CPEs interface[For example ETH00] and i get a log message in kibana as ETH00: Link is Down in syslog_message field and <158>Dec 2 07:14:01 cpe-base root: ETH00: Link is Down in message field
I created one monitor and trigger to check which interface is down using the visuals graph as follows when COUNT() OVER all documents FOR THE Last 1 hour(s) WHERE syslog_message is ETH00: Link is Down. Created an trigger and action as email destination.
My requirement is:
1) How can i know which CPEs ETH00 interface is down and i need to dynamically pass that CPEs IP in email subject and in mustache template.
2) How to add multiple filters during create monitor.