# Alert index is not getting generated

**URL:** https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [November 5, 2022, 4:52pm UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240 "2022-11-05T16:52:04Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![breakingcode](https://avatars.discourse-cdn.com/v4/letter/b/858c86/32.png) [@breakingcode](https://discuss.elastic.co/u/breakingcode)
#### Post date: [November 5, 2022, 4:52pm UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240/1 "2022-11-05T16:52:04Z")

</div>

Hii, I am creating alerts for my data view. I configured the rule as if salary property in data view extends some value an document with alert info will be saved in alert index. But when I enable my rule no alert index is getting created. I tried with creating the alert index by my own but, rule is not indexing the info in that index too. I am using 8.4.3 version of Kibana and Elasticsearch. My rule is not showing any error. It is showing status as Ok.  
Any suggestion what I might be doing wrong, I read similar post related to this issue but they didn't work in my case. According to the documentation my configurations should work  
Thanks

this is employee index for which I am checking the condition on salary \< 20000.

```auto
{
  "employees": {
    "mappings": {
      "properties": {
        "created_at": {
          "type": "date"
        },
        "dateTime": {
          "type": "long"
        },
        "id": {
          "type": "text"
        },
        "name": {
          "type": "text"
        },
        "salary": {
          "type": "double"
        }
      }
    }
  }
}

```

I created data view with created\_at as the time field.  
I am using Index rule type, this is the document which I want to index in alert index which I have not created.

```auto
{
  "rule_id": "{{rule.id}}",
  "context_message": "{{context.message}}",
  "rule_name": "{{rule.name}}",
  "alert_id": "{{alert.id}}"
}

```

When test my query while configuring the rule it returns documents so I guess my query is working. My rule run every 10 seconds and sends reponse as Ok

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [November 5, 2022, 8:11pm UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240/2 "2022-11-05T20:11:16Z")

</div>

Hi @breakingcode

You are going to need to show / share your type of alert rule, alert rule configuration, preview data (did you test in in the setup screen?) The Data, The Conditions etc... etc...

i.e. We can't help you without _ **a lot** _ of details... otherwise we are just guessing... you told us a problem but gave us no details to go on.

The more detail you provide in a clear manner the better chance someone can help you.

Oh, and definitely include the version of the stack. New features come available so fast!.

---

<div class="post-metadata">

### Author: ![breakingcode](https://avatars.discourse-cdn.com/v4/letter/b/858c86/32.png) [@breakingcode](https://discuss.elastic.co/u/breakingcode)
#### Post date: [November 6, 2022, 7:51am UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240/3 "2022-11-06T07:51:40Z")

</div>

You're right, I should've shared the code. Actually, I was trying this example on my work system that's why I didn't shared the code. I have shared the code now you can check.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [November 6, 2022, 3:37pm UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240/4 "2022-11-06T15:37:02Z")

</div>

> [@breakingcode](#):
>
> When test my query while configuring the rule it returns documents so I guess my query is working. My rule run every 10 seconds and sends reponse as Ok

Please show screenshots/ code of the the type of alerts (There is no Index Rule, there is an Index Action) entire rule setup and test outcome and the action. We can't debug the rule without seeing it.

Did you set up an index connector?

Are you sure there are documents that meet the threshold within the time frame?

When you check on the rule execution and the details what do you see?

There is a ton of information there...

 ![Screen Shot 2022-11-06 at 7.34.21 AM](https://us1.discourse-cdn.com/elastic/original/3X/9/3/93f9c9f8458c9c11a5f40526cd65052ad85378ca.jpeg)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 4, 2022, 3:37pm UTC](https://discuss.elastic.co/t/alert-index-is-not-getting-generated/318240/5 "2022-12-04T15:37:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
