query_key
which will group documents by certain key and then count them separetely. So for example, if you have frequency type with num_events: 10
plus query_key: hostname
, it would only alert if a single hostname got more than 10 events
use_terms_query
which will make a terms aggregation query instead of normal query if there are too many documents
pip install -r requirements.txt
, it will use a known working (and compatible) list dependencies, though some of those versions are pretty old
When I run python setup.py install I get the following error Running blist-1.3.6/setup.py -q bdist_egg --dist-dir /tmp/easy_install-xDDIzl/blist-1.3.6/egg-dist-tmp-PPWuCk
warning: no files found matching 'blist.rst'
blist/_blist.c:38:20: fatal error: Python.h: No such file or directory
^
compilation terminated.
error: Setup script exited with error: command 'gcc' failed with exit status 1
I think this a PiP issue but I dont know how to fix it yet.
query_key: filename
and the flatline will trigger independently for each value of the field filename