I am having trouble creating ESA alerts that trigger when the alert.id
metakey is populated by an app rule. The issue is that there are
multiple app rules using the alert.id field and ESA alerts appear to
only trigger on the first alert.id value (bas...
Do you need to restart the ESA service after changing a metakey from a
string to an array? As I mentioned in another post, I made the change
you suggested, but it doesn't seem to have done anything, as the metakey
references page still indicates that...
The alert metakey on on our implementation was configured as a string. I
attempted to make the changes John specified to configure it as an array
so that I could use it for alerting purposes, but it doesn't appear to
work. I made the change described...
