# Alert notification with percolator
**URL:** https://discuss.elastic.co/t/alert-notification-with-percolator/23070
**Category:** Elasticsearch
**Created:** [April 2, 2015, 6:25pm UTC](https://discuss.elastic.co/t/alert-notification-with-percolator/23070 "2015-04-02T18:25:22Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Lincoln\_Xiong](https://discuss.elastic.co/u/Lincoln_Xiong)
#### Post date: [April 2, 2015, 6:25pm UTC](https://discuss.elastic.co/t/alert-notification-with-percolator/23070/1 "2015-04-02T18:25:22Z")
I try to use elasticsearch as a 2nd log output storage, to analyze some
info in logs. In this case, an alert triggers will be very useful. I read
through docs talking about percolator and I think this should be the way to
make it out.But after some trying, I found that I don't really get how
percolator works. It seems that I use REST API to index a document with a
percolator already set up, it will return if that document match the
percolator query or not. For my case, I use Logstash as input which of
course don't have this kind of feedback. And a "count" appears to be
accessible from REST that I can use to get this kind "feedback" from
percolator but I find it no where.
Could some one give me an idea about how I can achieve this kind of feature
with Elasticsearch?
I know I can have ways to trigger an alert in Logstash but for my case
Logstash is a temporary tool to input the data, I could possible not use it
in the future.
I also notice that Graylog has kind of alert. When the input event match
some keywords, the alarm will trigger. I guess it also use some percolator
APIs but I wish to know how can I do this alone with Elasticsearch only.
Thanks a lot.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@roger](https://discuss.elastic.co/u/roger)
#### Post date: [April 2, 2015, 9:13pm UTC](https://discuss.elastic.co/t/alert-notification-with-percolator/23070/2 "2015-04-02T21:13:21Z")
I have never used percolator, but afaik you have to call the percolator api
after you have the document indexed:
> **[Percolate query | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-percolate-query.html)**
2015-04-02 15:25 GMT-03:00 Lincoln Xiong [xiong.huanglin@gmail.com](mailto:xiong.huanglin@gmail.com):
> I try to use elasticsearch as a 2nd log output storage, to analyze some
> info in logs. In this case, an alert triggers will be very useful. I read
> through docs talking about percolator and I think this should be the way to
> make it out.But after some trying, I found that I don't really get how
> percolator works. It seems that I use REST API to index a document with a
> percolator already set up, it will return if that document match the
> percolator query or not. For my case, I use Logstash as input which of
> course don't have this kind of feedback. And a "count" appears to be
> accessible from REST that I can use to get this kind "feedback" from
> percolator but I find it no where.
>
> Could some one give me an idea about how I can achieve this kind of
> feature with Elasticsearch?
>
> I know I can have ways to trigger an alert in Logstash but for my case
> Logstash is a temporary tool to input the data, I could possible not use it
> in the future.
> I also notice that Graylog has kind of alert. When the input event match
> some keywords, the alarm will trigger. I guess it also use some percolator
> APIs but I wish to know how can I do this alone with Elasticsearch only.
>
> Thanks a lot.
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAJp2530%2BAkecJAbVnQ3E8X1\_iWNqzAK%3DmbDkHgECAomZgnfdrg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAJp2530%2BAkecJAbVnQ3E8X1_iWNqzAK%3DmbDkHgECAomZgnfdrg%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Lincoln\_Xiong](https://discuss.elastic.co/u/Lincoln_Xiong)
#### Post date: [April 6, 2015, 2:12pm UTC](https://discuss.elastic.co/t/alert-notification-with-percolator/23070/3 "2015-04-06T14:12:35Z")
Yeah I have done something with that. For now there is a .percolator in my
index mapping. But I failed to get further interact with that, which I
mean, according to the docs, percolator should be an "index"? But I cannot
find any additional index on my node after I set a percolator query...And
also, there is a count API I can use to check how many events hits by the
percolator query, I also cannot make that work...
Can anyone give me an example of how you setup the percolator as an alert
or similar?
So here is what my percolator looks like when I get the mapping of the
index....
".percolator" : {
"\_id" : {
"index" : "not\_analyzed"
},
"properties" : {
"query" : {
"enabled" : false,
"type" : "object"
}
}
}
On Thursday, April 2, 2015 at 5:13:39 PM UTC-4, Roger de Cordova Farias
wrote:
> I have never used percolator, but afaik you have to call the percolator
> api after you have the document indexed:
>
> [Percolate query | Elasticsearch Guide [8.11] | Elastic](http://www.elastic.co/guide/en/elasticsearch/reference/current/search-percolate.html#_percolating_an_existing_document)
>
> 2015-04-02 15:25 GMT-03:00 Lincoln Xiong \<[xiong.h...@gmail.com](mailto:xiong.h...@gmail.com)
> \\>:
>
> > I try to use elasticsearch as a 2nd log output storage, to analyze some
> > info in logs. In this case, an alert triggers will be very useful. I read
> > through docs talking about percolator and I think this should be the way to
> > make it out.But after some trying, I found that I don't really get how
> > percolator works. It seems that I use REST API to index a document with a
> > percolator already set up, it will return if that document match the
> > percolator query or not. For my case, I use Logstash as input which of
> > course don't have this kind of feedback. And a "count" appears to be
> > accessible from REST that I can use to get this kind "feedback" from
> > percolator but I find it no where.
> >
> > Could some one give me an idea about how I can achieve this kind of
> > feature with Elasticsearch?
> >
> > I know I can have ways to trigger an alert in Logstash but for my case
> > Logstash is a temporary tool to input the data, I could possible not use it
> > in the future.
> > I also notice that Graylog has kind of alert. When the input event match
> > some keywords, the alarm will trigger. I guess it also use some percolator
> > APIs but I wish to know how can I do this alone with Elasticsearch only.
> >
> > Thanks a lot.
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/cf5da9d8-7000-4a0b-94af-3ce064feee90%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e915015b-8438-4ad4-99ca-6eaa66033581%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e915015b-8438-4ad4-99ca-6eaa66033581%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:21am UTC](https://discuss.elastic.co/t/alert-notification-with-percolator/23070/4 "2017-07-06T00:21:29Z")