Hi All,
I get a problem in alert configuration. I find that the alerts can be triggered successfully when the alert is searching the main index, but my newly created indexes are failed to trigger any alerts. Could anyone advise on this issue?
PS: my savedsearch config is under the "search" app with the owner "admin"
Debug it by logging as user admin
and running the alert's search, peeling off piped clauses from the right side until you get data that you expect. There could be a problem with permissions
or maybe even the "indexes searched by default" setting; to eliminate the latter, be sure to explicitly sent your index with index=*
or similar.