AnsweredAssumed Answered

How to alert based on multiple meta keys?

Question asked by Uma Mahesh Padisetty on Jul 27, 2017
Latest reply on Jul 31, 2017 by Christopher Ahearn

Hi,

Scenerio:

A log is parsed into below meta keys

   aba = 'xxxx'

   dda = 'yyyy'

   .....

 

I have blacklist of aba,dda pair

      blacklisted_account,aba1,dda1

      blacklisted_account,aba2,dda2

 

I need to alert if any log has aba=aba1 and dda=dda1

                         OR               aba=aba2 and dda=dda2

 

I should not alert when aba=aba1 and dda=dda2

 

-----------
One solution i have in mind is as below which i am not sure works.

To create custom meta key which is created while log is parsed by SA

          abadda = aba||'!'||dda

Feed is    

      tags,abadda

       blacklisted_account,aba1!dda1
       blacklisted_account,aba2!dda2

 

ESPER Alert

      'blacklisted_account'=ANY(tags)              

 

-------------

Hence i am looking for a way to create abadda (a custom meta key carved out of existing metakeys)

Or

Alternative way to accomplish above alerting.

 

Thanks,

Uma Mahesh | 7068402149

ADP

Outcomes