securityonion/salt/influxdb/templates/alarm_logstash_eps.json

[{
    "apiVersion": "influxdata.com/v2alpha1",
    "kind": "CheckThreshold",
    "metadata": {
            "name": "alarm-logstash-eps"
    },
    "spec": {
            "every": "1m0s",
            "name": "Logstash EPS at 0",
            "query": "from(bucket: \"telegraf/so_short_term\")\n  |\u003e range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |\u003e filter(fn: (r) =\u003e r[\"_measurement\"] == \"logstash_events\")\n  |\u003e filter(fn: (r) =\u003e r[\"_field\"] == \"in\")\n  |\u003e aggregateWindow(every: 1m, fn: mean, createEmpty: false)\n  |\u003e yield(name: \"mean\")",
            "status": "active",
            "statusMessageTemplate": "Check: ${ r._check_name } is: ${ r._level }",
            "thresholds": [
                    {
                            "level": "CRIT",
                            "type": "lesser",
                            "value": 1
                    }
            ]
    }
}]