I would like to create an Event Definition for a message that was generated for a license renewal,not sure if I need to focus on a Pipeline/Extractor or if there is another way of accomplishing this. In this example I have a stream Called “License Expiring”, it has a rule called “Field EventID must match exactly 24040”. This collects a message every day around 6PM for 30 days (i.e. License Expires on the 30th day). What I would like to happen is to create alert/notification 5 days prior, then every day after that, before the 30 days is up. What I have tried with no success is to create a pipeline rule with something similar like this;
rule " License Expiring "
has_field(“message”) AND contains(“expire”,to_string($message.message))
rule “5 Days”
// count 15 days
to_long(to_date($message.timestamp, “American/Chicago”).count_day) == 15
route_to_stream(name:“License Expiring In 5 Days”);
Unfortunately, this rule does not work and I’m not very good at creating pipelines yet.
If I could get something like this to work, I would route it to another Stream called “License Expiring In 5 Days”
Then I could create a notification/alert.
CentOS 7 Latest Version
Any advice, Ideas or direction would be appreciated.
Thank you in advance.