elasticsearch – Elastic Query to alert only when a certain logs comes more than a custom threshold

I have an echo alarm set like this

{"query": {
    "bool" : {
      "must" : [
          {"regexp":{"messageDetail.uri": "/v[1,2]/ccpa/.*"}},
          {"range":{"timestamp":{"gte":"now-60m/m"}}},
          {"range":{"responseCode":{"gte":500}}}
      ],
     "must_not": [
          {"regexp": {"message": ".*requestqueuedoesnotexist.*"}}
      ]
    }
  },
  "size":0
}

This creates an alert whenever there is a 500 response code in the last 60minutes . I wan to change it to alert only when 500 response code comes more than 100 times in the last 60 minutes instead of just one. How can this be achieved.?

Read more here: Source link