Logs alert creation

[mukeshelastic]

Summary of the problem

As an observability user persona, I'd like to create alerts for following use cases:

1. When the count of (ECS.field = value) > static threshold within last X time unit then send a slack message that contains document.field value

Alert definition UI

When count of <ecs.field = value> is greater than integer within last 5 minutes

2. When the count of ( message contains ) crosses a static threshold within the last X time unit then send me a message

Alert definition UI

When the count of ( ecs.field contains ) is greater than an integer threshold in last five minutes

3. document message contains a specific log pattern AND/NOT other log patterns in the same document then send a message

Alert definition UI

When the ecs.field contains , AND ecs.field does not contain <text pattern 3> in last five minutes

4. (Stretch Goal) the count of ( message contains text pattern) for each bucket represented by a unique value in specific ecs.field, goes beyond a static threshold

Alert definition UI

When the count of( ecs.field contains <text pattern 1>, ) group by ecs.field is greater than integer threshold in last five minutes

5. (Stretch Goal) Creating alerts from anomaly explorer tabular information

[elasticmachine]

Pinging @elastic/observability-design (design)

[katrin-freihofner]

[katrin-freihofner]

The alert conditions have been changed to the following: