# Active Alert

**URL:** <https://discuss.elastic.co/t/active-alert/70058>\
**Category:** Elasticsearch\
**Created:** [December 27, 2016, 10:11am UTC](https://discuss.elastic.co/t/active-alert/70058 "2016-12-27T10:11:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bini/32/18360_2.png) [@bini](https://discuss.elastic.co/u/bini)\
**Post date:** [December 27, 2016, 10:11am UTC](https://discuss.elastic.co/t/active-alert/70058/1 "2016-12-27T10:11:03Z")

</div>

“Active Alerts” – something like “Username, coming in from IP x.y.z is consuming a high number of database connections.” Is this possible? please let me know

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 27, 2016, 8:11pm UTC](https://discuss.elastic.co/t/active-alert/70058/2 "2016-12-27T20:11:49Z")

</div>

Yes it is.

---

<div class="post-metadata">

**Author:** ![bini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bini/32/18360_2.png) [@bini](https://discuss.elastic.co/u/bini)\
**Post date:** [December 28, 2016, 6:14am UTC](https://discuss.elastic.co/t/active-alert/70058/3 "2016-12-28T06:14:37Z")

</div>

@warkolm thanks, So this can be done using watcher if i m correct.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 28, 2016, 8:28pm UTC](https://discuss.elastic.co/t/active-alert/70058/4 "2016-12-28T20:28:27Z")

</div>

Correct.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [December 29, 2016, 8:54am UTC](https://discuss.elastic.co/t/active-alert/70058/5 "2016-12-29T08:54:14Z")

</div>

@bini the input of most watches is an elasticsearch query. So all you have to do is to find and create the elasticsearch query you want and make sure this query is part of a watch.

---

<div class="post-metadata">

**Author:** ![bini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bini/32/18360_2.png) [@bini](https://discuss.elastic.co/u/bini)\
**Post date:** [January 5, 2017, 6:17am UTC](https://discuss.elastic.co/t/active-alert/70058/6 "2017-01-05T06:17:16Z")

</div>

thanks @spinscale

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2017, 6:17am UTC](https://discuss.elastic.co/t/active-alert/70058/7 "2017-02-02T06:17:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.