Hi,
Scenerio:
A log is parsed into below meta keys
aba = 'xxxx'
dda = 'yyyy'
.....
I have blacklist of aba,dda pair
blacklisted_account,aba1,dda1
blacklisted_account,aba2,dda2
I need to alert if any log has aba=aba1 and dda=dda1
OR aba=aba2 and dda=dda2
I should not alert when aba=aba1 and dda=dda2
-----------
One solution i have in mind is as below which i am not sure works.
To create custom meta key which is created while log is parsed by SA
abadda = aba||'!'||dda
Feed is
tags,abadda
blacklisted_account,aba1!dda1
blacklisted_account,aba2!dda2
ESPER Alert
'blacklisted_account'=ANY(tags)
-------------
Hence i am looking for a way to create abadda (a custom meta key carved out of existing metakeys)
Or
Alternative way to accomplish above alerting.
Thanks,
Uma Mahesh | 7068402149
ADP
Would an app rule work in this case?
name=blacklisted_account rule= aba = 'aba1' && dda = 'dda1'
This assumes that both 'aba' and 'dda' were meta keys.