Index Threshold Alert Filter

[andystroz]

Describe the feature:

The alert rule 'Index Threshold' should have a box like the 'Elastic Search Query' that lets you specify a query that scopes the aggregation being done.

Describe a specific use case for the feature:

I have an index with logs from multiple deployments being dumped in it that all have the field "deployment". I would like to specify different rules for certain deployments while using the 'Index Threshold' alerting rule. There is currently no way to filter your results before Grouping.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[mikecote]

Hi @andystroz, thank you for your enhancement request. We've been tracking the filtering feature under #66046. I've copied your use case into it, so we do not forget. So I will close this issue in favour of #66046.