Alert for every document based on the field value

[breakingcode]

Hi,

We have a requirement in which we have to setup alerting system based on the field value of the document. So document will be like this

{
........
........
breach: "false"/"true"
........
}

Based of the 'breach' field we want to send the alert as email. An alert should be triggered for every document containing the 'breach' values as "false" and separate mail should be received for each document.

I am not sure if this is possible with Kibana. Which rule type should I use and is it possible to send alert for individual document, if not what other similar option I can use to solve this problem ?

Thanks

[dgieselaar (Dario Gieselaar)]

Hi @breakingcode! If you want to alert on every document that matches a certain filter, you might be able to use the Elasticsearch query type: Elasticsearch query | Kibana Guide [8.5] | Elastic. Does that work for you?

[breakingcode]

Thank for the reply,
I can see data in data view. I am only getting alert for first time when I enable my rule, after that when I index another doc it does not send alert, rule status shows its active.

I chose Notify option with 'Only on status change' I guess this is where I am wrong, but other two options do not get along with my use case.

[Patrick_Mueller (Patrick Mueller (Kibana Alerting))]

The Elasticsearch query currently only triggers one action per run, so may not be appropriate for you.

I don't think we have a rule-type that would work out-of-the-box for this, but this might work:

• create a "filtered alias" of your index that filters out breach: true documents
• use index threshold rule type using that alias
• "group by" with a field that is unique per document; you will also have to specify the maximum number of groups, as it uses a term agg under the covers
• alerts will fire with a context value indicating the unique field per group

Note that index threshold does not de-duplicate docs between runs. So if the rule interval is 5 minutes but "for the last" (look back) is 10 minutes, you'll get dups. That's probably fine, as the dups won't run actions if you use Notify: On status changes (the default).

Currently planned to ship in 8.6, index threshold rule type will allow you to pass a filter in directly, so that you wouldn't need to create a filtered index. Add filter field to index threshold rule type by ersin-erdal · Pull Request #142255 · elastic/kibana · GitHub

[breakingcode]

Thanks for the answer, will definitely try this and revert back.