Configure Spike Alerts for OpenSearch

A Spike alert matches when the volume of events during a given time period is larger or smaller based on spike_height than during the previous time period timeframe.

This would allow you to receive alerts in scenarios such as if there is 3 times spike up based on a ratio value spike_height in the number of events matching the filter query, when compared to the previous time window for events timeframe.

Here is an example below:

name: "Spike example alert"
type: spike
index: "*-*"
timeframe:
  hours: 2
spike_height: 3
spike_type: "up"
query:
  query_string:
    query: "router.status: [500 TO 599]"
alert:
  - "email"
email:
  - "[email protected]"

Additional Options

In addition, you can also provide a threshold_cur value that allows you to configure the minimum number of events that must exist in the current window for an alert to be fired.