How to create alert based on multiple queries?

[fadjar340]

Sorry for my bad English, not my mother tongue…

Oke, I’ll explain

1. Create the different datasource, in my case, I use metricbeat and auditbeat
2. Build new dashboard using Graph Visualization
3. Select the datasource to --Mixed–
   
4. Add first query A for first datasource by selecting the datasource using +Query, select Metricbeat
   
5. Build the query as you need…
6. Add second query B for datasource auditbeat using select the datasource using +Query
   
   
   
   Above steps, create multiple query in the same Graph
   
   

Now, we go to the Alerts
7. Open the Alert tab and create the alert using the Create Alert Button
8. Create the Alert for Query A

9. Add the alert for query B using sign +
10.You can select the condition of the alerts, OR - AND

11. Change the second alert to query B

12. Now you have multiple alerts in the same Graph with multiple datasource.

13. SAve the dashbord first.
14. You can test the alert using Test Rule button in the last of the configuration
15. Below the test result

I wish this helps you…