You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Tracking threshold alert type runs an {es} query over indices, comparing the latest
62
-
entity locations with their previous locations. In the event that an entity has crossed a
63
-
boundary from the selected boundary index, an alert may be generated.
64
-
65
-
[float]
66
-
==== Defining the conditions
67
-
Tracking threshold has a *Delayed evaluation offset* and 4 clauses that define the
68
-
condition to detect, as well as 2 Kuery bars used to provide additional filtering
69
-
context for each of the indices.
70
-
71
-
[role="screenshot"]
72
-
image::images/alert-types-tracking-threshold-conditions.png[Five clauses define the condition to detect]
73
-
74
-
75
-
Delayed evaluation offset:: If a data source lags or is intermittent, you may supply
76
-
an optional value to evaluate alert conditions following a fixed delay. For instance, if data
77
-
is consistently indexed 5-10 minutes following its original timestamp, a *Delayed evaluation
78
-
offset* of `10 minutes` would ensure that alertable instances are still captured.
79
-
Index (entity):: This clause requires an *index or index pattern*, a *time field* that will be used for the *time window*, and a *`geo_point` field* for tracking.
80
-
By:: This clause specifies the field to use in the previously provided
81
-
*index or index pattern* for tracking Entities. An entity is a `keyword`
82
-
or `number` field that consistently identifies the entity to be tracked.
83
-
When entity:: This clause specifies which crossing option to track. The values
84
-
*Entered*, *Exited*, and *Crossed* can be selected to indicate which crossing conditions
85
-
should trigger an alert. *Entered* alerts on entry into a boundary, *Exited* alerts on exit
86
-
from a boundary, and *Crossed* alerts on all boundary crossings whether they be entrances
87
-
or exits.
88
-
Index (Boundary):: This clause requires an *index or index pattern*, a *`geo_shape` field*
89
-
identifying boundaries, and an optional *Human-readable boundary name* for better alerting
0 commit comments