# Alert based on field

**URL:** https://discuss.elastic.co/t/alert-based-on-field/319582
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [November 22, 2022, 7:25pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582 "2022-11-22T19:25:44Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![breakingcode](https://avatars.discourse-cdn.com/v4/letter/b/858c86/32.png) [@breakingcode](https://discuss.elastic.co/u/breakingcode)
#### Post date: [November 22, 2022, 7:25pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582/1 "2022-11-22T19:25:44Z")

</div>

Hii,  
This is my scenario. I have one index named "employee" which have 3 fields name, salary and created\_at. I want to trigger an alert everytime someone index the document with salary below certain value. For example if salary \< 20000 I want to trigger an alert. I don't understand which type of rules should I use.  
I am not sure if there is any way to alert based on field values.

---

<div class="post-metadata">

### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [November 22, 2022, 8:06pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582/2 "2022-11-22T20:06:43Z")

</div>

Index threshold rule is what you want:

> **[Index threshold | Kibana Guide \[8.5\] | Elastic](https://www.elastic.co/guide/en/kibana/current/rule-type-index-threshold.html)**
>
> Kibana provides you with several options to share \*Discover\* saved searches, dashboards, \*Visualize Library\* visualizations, and \*Canvas\* workpads with others, or on a website.

---

<div class="post-metadata">

### Author: ![breakingcode](https://avatars.discourse-cdn.com/v4/letter/b/858c86/32.png) [@breakingcode](https://discuss.elastic.co/u/breakingcode)
#### Post date: [November 23, 2022, 6:16am UTC](https://discuss.elastic.co/t/alert-based-on-field/319582/3 "2022-11-23T06:16:41Z")

</div>

Thanks for the answer. My conditions is working, but alert is not triggered when I add another document in the index. What should I select in "Notify me"?  
I only want to notify when someone index the document which meet the condition

 ![alert_config](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d929957440ec19a89f63f0715b905298c2eb3a1.png)

---

<div class="post-metadata">

### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [November 28, 2022, 8:49pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582/4 "2022-11-28T20:49:36Z")

</div>

Are you sure the new document added has a `created_at` date that falls within the condition set in the alert logic (i.e. in the last 5 days)?

---

<div class="post-metadata">

### Author: ![breakingcode](https://avatars.discourse-cdn.com/v4/letter/b/858c86/32.png) [@breakingcode](https://discuss.elastic.co/u/breakingcode)
#### Post date: [November 30, 2022, 7:16pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582/5 "2022-11-30T19:16:59Z")

</div>

yes!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 28, 2022, 5:31pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582/6 "2022-12-28T17:31:41Z")

</div>



---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 25, 2023, 5:32pm UTC](https://discuss.elastic.co/t/alert-based-on-field/319582/7 "2023-01-25T17:32:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.