Check Ramses [1][2] + Elastalert [3]. I'll be happy to help.
[1] disclosure: I'm one of the core dev [2] http://ramses.readthedocs.org [3] https://elastalert.readthedocs.org
[1] disclosure: I'm one of the core dev [2] http://ramses.readthedocs.org [3] https://elastalert.readthedocs.org