# Alert on repeated ping failures

**URL:** <https://discuss.elastic.co/t/alert-on-repeated-ping-failures/138981>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [July 6, 2018, 9:13pm UTC](https://discuss.elastic.co/t/alert-on-repeated-ping-failures/138981 "2018-07-06T21:13:55Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 8, 2018, 1:02pm UTC](https://discuss.elastic.co/t/alert-on-repeated-ping-failures/138981/2 "2018-07-08T13:02:46Z")

</div>

You can build your own dashboards in Kibana. I would start with the [Time Series Visual Builder](https://www.elastic.co/guide/en/kibana/current/time-series-visual-builder.html) if I were creating a new visualization.

This is one that I use with Heartbeat.

 ![heartbeat-icmp](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9e04368fae1bf5163145884dcacf8b06500b07e1.png)

Then for Altering I use [Watcher](https://www.elastic.co/products/x-pack/alerting) which is part of X-Pack. This will create a watch that queries the data every 60s and looks for hosts that were down and sends me a Slack notification.

```auto
PUT _xpack/watcher/watch/heartbeat-monitor-status-down
{
    "trigger": {
      "schedule": {
        "interval": "1m"
      }
    },
    "input": {
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat-*"
          ],
          "types": [],
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "must": [
                  {
                    "term": {
                      "monitor.status": {
                        "value": "down"
                      }
                    }
                  }
                ],
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "from": "now-1m"
                      }
                    }
                  }
                ]
              }
            },
            "aggregations": {
              "by_monitors": {
                "terms": {
                  "field": "monitor.id",
                  "size": 10,
                  "min_doc_count": 1
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "compare": {
        "ctx.payload.hits.total": {
          "gt": 0
        }
      }
    },
    "actions": {
      "notify-slack": {
        "throttle_period_in_millis": 900000,
        "slack": {
          "account": "monitoring",
          "message": {
            "from": "Heartbeat",
            "text": "Some hosts are unresponsive.",
            "dynamic_attachments": {
              "list_path": "ctx.payload.aggregations.by_monitors.buckets",
              "attachment_template": {
                "color": "warning",
                "title": "{{key}}",
                "text": "Total events: {{doc_count}}"
              }
            }
          }
        }
      }
    }
}

```

> <https://twitter.com/Krohbird/status/849749788920877056>

---

_[View the full topic](https://discuss.elastic.co/t/alert-on-repeated-ping-failures/138981)._