Skip to content

OpenSearch Keyword

OpenSearch Keyword Monitor in MCT is a type of synthetic check that searches for specific keywords in Opensearch logs to detect exceptions and trigger alerts. This monitor simulates queries to Opensearch instances, searches for predefined keywords in the logs, and sends out alerts if the keywords are detected and matched pre-set amount.

Configuration

Zone Level

  • Authentication Mode: Select the authentication mode.
  • Username: Required if Authentication Mode is set to 0 (Basic Authentication) or 2 (Cisco SSO).
  • Password: Required if Authentication Mode is set to 0 (Basic Authentication) or 2 (Cisco SSO).
  • Scope: Required if Authentication Mode is set to 1 (CI Machine Account).
  • Environment: Select the ES environment for testing.

Check Leve

  • Base URL: The base URL of the Elasticsearch service, e.g., https://api-logs-noram-int.wbx2.com/app. This is required.
  • Topic: The Elasticsearch topic to monitor. This is required.
  • Syntax: Select the syntax rule for the query.
  • Server Type (svrType): Required if Syntax is set to 0 (Keyword). This describes the ES machine server type.
  • Message: Required if Syntax is set to 0 (Keyword). This is the message to be matched (or unmatched).
  • Past Minutes (pastMins): Required if Syntax is set to 0 (Keyword). This defines the time range filtered in the past x minutes. Default: 1.
  • Count Query DSL: Required if Syntax is set to 1 (DSL). This is the query DSL, e.g., {"query":{"match_all":{}}}.
  • Alerting Rule: Select the rule to alert when matching or unmatching.
  • Times: The number of times the words need to be matched to trigger an alert. Default: 1.

Source Code