# Alert query for kubernetes **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [February 21, 2021, 8:12pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003 "2021-02-21T20:12:24Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![alfredo.deluca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alfredo.deluca/32/95381_2.png) [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Post date:** [February 21, 2021, 8:12pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/1 "2021-02-21T20:12:24Z")
Hi all. I use elastic cloud 7.11.0 and we have filebeat and metricbeat running on a k8s cluster. I also have an alert on watcher to send and aletr when a POD in the kubernetes cluster goes down. Now the query it's fine but I need to make it better, just sending one and only one alert to atlassian (OPSGenie). and not every minute or even every 10. Just one. Any idea how to make the query? Cheers ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 21, 2021, 8:17pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/2 "2021-02-21T20:17:59Z")
Hi @alfredo.deluca You are in luck, Alert Only Once on state change was just released as part of 7.11. These new features allow you to do two things 1. just as you asked notify only once so when the alert fires you can set it to only execute the action once 2. you can also set the alert to send an alert once when the condition is no longer met / it's resolved Check out 7.11.1 it has a couple fixes in it that help this functionality work better. ---
**Author:** ![alfredo.deluca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alfredo.deluca/32/95381_2.png) [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Post date:** [February 21, 2021, 9:26pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/3 "2021-02-21T21:26:15Z")
Hi Stephen. That's great news. Is it already available on [elastic.co](http://elastic.co) cloud? Cheers ---
**Author:** ![alfredo.deluca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alfredo.deluca/32/95381_2.png) [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Post date:** [February 21, 2021, 9:29pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/4 "2021-02-21T21:29:59Z")
Just checked and it's available to deploy... great. Thanks again. I will give it a try tomorrow Cheers ---
**Author:** ![alfredo.deluca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alfredo.deluca/32/95381_2.png) [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Post date:** [February 23, 2021, 2:11pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/5 "2021-02-23T14:11:01Z")
Hi Stephen. I read and saw the new feature but if I use watcher I am not going to be able to use that feature. is that right? Alfredo ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 23, 2021, 2:41pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/6 "2021-02-23T14:41:26Z")
You need to code it yourself in watchers. Watcher does have alert state if I recall but you would need to write all the logic for only send action on state change. ---
**Author:** ![alfredo.deluca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alfredo.deluca/32/95381_2.png) [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Post date:** [February 23, 2021, 3:21pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/7 "2021-02-23T15:21:43Z")
Ok ... I was guessing that. Thanks heaps Cheers ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 23, 2021, 3:22pm UTC](https://discuss.elastic.co/t/alert-query-for-kubernetes/265003/8 "2021-03-23T15:22:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.