Want to set up Alert for any query results from Elasticsearch index pattern with error/critical log level

  • What Grafana version and what operating system are you using?

Grafana v6.6.2 - not sure what OS it is running on

Accessing Grafana from Chrome and Microsoft Edge browsers on Windows 10 laptop…

  • What are you trying to achieve?
  1. Set up Grafana dashboard to query a particular index pattern in Elasticsearch for documents that match log.level == critical or error within a given time frame. log.level is confirmed to be one of the JSON document properties.
  2. Set up an Alert that will send me an email if more than 3 results are returned for the query in #1 above. We already have dashboards in Kibana that show us the same log records but I understand I cannot have an Alert in Grafana without a Grafana dashboard.
  • How are you trying to achieve it?
  1. Set up a Grafana Data Source with the Elasticsearch endpoint and what index pattern to use.
  2. Created a Grafana Dashboard to use the Data Source.
  • What happened?

I’m stuck at putting in the filter for log.level == critical or error. I can’t find the documentation on how to do this and searching the community doesn’t turn up the needed info.

When I create a Dashboard, and add a Query, I only see the Metric type of Query. I don’t have a way to change it to a Log Query. When I go to Explore, I get the Log option for Query but there is no way to save my Search so that I can reuse it in a Dashboard, unlike in Kibana where all of this is so easy.

  • What did you expect to happen?

See “what are you trying to achieve”