I have an alert set up on an index. The alert should send out an email.
If I set up the alert with the query
{
"query": {
"bool": {
"must" : [
{ "term" : { "Properties.EventId.Id" : 1 } }
]
}
}
}
the email specified in the alert is send.
If I st up the alert with the query
{
"query": {
"bool": {
"must": [
{
"term": {
"kubernetes.namespace": "mynamespace"
}
}
]
}
}
}
then the email for the alert is also send.
Combining these 2 properties with an "AND" condition does not work.
{
"query": {
"bool": {
"must": [
{
"term": {
"Properties.EventId.Id": 1
}
},
{
"term": {
"kubernetes.namespace": "mynamespace"
}
}
]
}
}
}
I can see that there are matching documents when I run "Test query", but an email is never send.
There are no errors in "Error log"
Is there something missing? The version of elastic is 8.2.2