# Alert changes in documents
**URL:** https://discuss.elastic.co/t/alert-changes-in-documents/348561
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [December 4, 2023, 1:37pm UTC](https://discuss.elastic.co/t/alert-changes-in-documents/348561 "2023-12-04T13:37:47Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@tmslara.a](https://discuss.elastic.co/u/tmslara.a)
#### Post date: [December 4, 2023, 1:37pm UTC](https://discuss.elastic.co/t/alert-changes-in-documents/348561/1 "2023-12-04T13:37:47Z")
Hello,
I'm trying to implement an alert system in Elasticsearch. I'll describe the key elements of the problem and my solution attempts until now.
_Scenario_
We are ingesting information into an Elasticsearch index using Filebeat. I can define a relevant set of features among the existing variables. These are: device\_id, timestamp, and used\_flag. used\_flag may take different values, let's say five values. Each device sends information into Elasticsearch informing its timestamp and the used flag at the time.
**We are interested in notifying a user each time a device changes the used flag.**
_Considered approach_
I've taken some ideas from [this previous question](https://discuss.elastic.co/t/how-to-query-for-changes/215812), and my current approach consists of the following procedure (not yet implemented). Index the information using the device\_id as document ID with the fields timestamp and used\_flag. Each time new data is received for device ID, search the document and identify if the previous used\_flag is the same as the current one. If it is not, alert and update the document.
_Issues_
My approach has many issues, most of them related to my ability to implement many operations. First, I don't know how can I implement the operation of searching the previous state of a document upon reception of an update. Second, I don't know how to send some kind of alert in Elasticsearch. I've mostly used the Python API to interact with Elasticsearch and perform more complex operations, however, as I'm sending the documents using Filebeat, this procedure does not seem appropriate.
I'd appreciate any insights regarding this problem. If you consider that could use another approach, it would be also appreciated.
Best regards,
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2024, 1:38pm UTC](https://discuss.elastic.co/t/alert-changes-in-documents/348561/2 "2024-01-01T13:38:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.