Rule type to be used to get particular keyword from message field in Kibana logs

[ratnakumarchukkapalli]

Hi Team,

I have one urgent request to implement elastalert2 to fetch particular keyword from message field in Kibana logs. Below is the message from the kibana log

REPORT INFO: Found 24 transaction to reconsile with status R

I want to extract the count(24) from above message and check if the count has exceeded 100 and raise an alert. C

Can this be done using elastalert2. Please help me. Any help is appreciated.

[jertel]

Look into scripted fields with Elasticsearch.