Configure Percentage Match Alerts for OpenSearch

A Percentage Match alert

A Percentage Match alert matches when the percentage of documents within a match_bucket_filter within a calculation window (by default buffer_time) is higher or lower than a relative percentage value max_percentage.

This would allow you to receive alerts in scenarios such as if there is a 20% increase max_percentage in the number of 500 errors match_bucket_filter within a 15 minutes timeframe buffer_time you would receive an alert to your configured channel.

Here is an example below:

name: "Percentage match example"
type: percentage_match
index: "*-*"
filter:
- query:
  query_string:
    query: "agent.hostname:azure"      
match_bucket_filter:
- query_string:
  query: "router.status: [500 TO 599]"    
doc_type: _doc
max_percentage: 20
buffer_time:  
  minutes: 3
alert:
- "email"
email:
- "[email protected]"

Additional Options

In addition, you can also provide a filter query to limit the initial results that the match_bucket_filter will be applied to.