如果两个字段值在给定时间间隔内出现 2 次以上，则创建 Kibana 观察器

如何解决如果两个字段值在给定时间间隔内出现 2 次以上，则创建 Kibana 观察器

任何人都可以帮助我在这种情况下创建警报 我有类似以下的日志事件

20200806 17:04:23.261 280018000 EV.WRN [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermkmID=f6y4j 的 TermRecord

20200806 17:04:23.261 280018000 EV.WRN [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermkmID=f6y4j 的 TermRecord

20200806 17:04:23.261 280018000 EV.INF [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermID=7yhe73v 的 TermRecord

20200806 17:04:23.261 280018000 EV.FNE [ MVINB-LSL2.T1G1_WEBSVR1 main.main TSP1.T1G1_WEBSVR1 ] 无法加载 TermID=j6ljudn 的 TermRecord 这里 EV.WRN 是“event_type”，“无法加载 TermID=f6y4jkm 的 TermRecord”是 log_message。

如果使用相同的“log_message”获得相同的“event_type”，我想创建一个警报 具有相同的术语 ID。有没有办法根据这种情况生成和警报。以下是我当前的观察者脚本。

{
   "trigger":{
      "schedule":{
         "interval":"10s"
      }
   },"input":{
      "search":{
         "request":{
            "search_type":"query_then_fetch","indices":[
               "testingalert*"
            ],"rest_total_hits_as_int":true,"body":{
               "size":0,"query":{
                  "bool":{
                     "must":{
                        "query_string":{
                           "query":"Failed to load TermRecord for TermID=/a-zA-Z0-9_.-/"
                        }
                     },"filter":{
                        "range":{
                           "@timestamp":{
                              "gte":"{{ctx.trigger.scheduled_time}}||-5m","lte":"{{ctx.trigger.scheduled_time}}","format":"strict_date_optional_time||epoch_millis"
                           }
                        }
                     }
                  }
               },"aggs":{
                  "log_message":{
                     "terms":{
                        "field":"log_message.keyword","size":10
                     },"aggs":{
                        "id":{
                           "terms":{
                              "field":"term_id.keyword","size":10
                           }
                        }
                     }
                  }
               }
            }
         }
      }
   },"condition":{
      "script":{
         "source":"ArrayList arr = ctx.payload.aggregations.log_message.buckets; for (int i = 0; i < arr.length; i++) { if (arr[i].doc_count > params.threshold) { return true; } } return false;","lang":"painless","params":{
            "threshold":2
         }
      }
   },"actions":{
      "send_email":{
         "email":{
            "profile":"standard","to":[
               "redacted"
            ],"subject":"Watcher Notification","body":{
               "text":"Watch [{{ctx.Metadata.name}}] The 'Terminal ID' alert has occured more than 5 times in 5 minutes interval of time"
            }
         }
      }
   },"transform":{
      "script":{
         "source":"HashMap result = new HashMap(); ArrayList arr = ctx.payload.aggregations.log_message.buckets; ArrayList filteredHits = new ArrayList(); for (int i = 0; i < arr.length; i++) { HashMap filteredHit = new HashMap(); filteredHit.key = arr[i].key; filteredHit.value = arr[i].doc_count; if (filteredHit.value > params.threshold) { filteredHits.add(filteredHit); } } result.results = filteredHits; return result;","params":{
            "threshold":2
         }
      }
   }
}