# Alert - Query to get distinct count

**URL:** <https://discuss.elastic.co/t/alert-query-to-get-distinct-count/287583>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [October 25, 2021, 1:38pm UTC](https://discuss.elastic.co/t/alert-query-to-get-distinct-count/287583 "2021-10-25T13:38:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fredrick.bb](https://avatars.discourse-cdn.com/v4/letter/f/7bcc69/32.png) [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\
**Post date:** [October 25, 2021, 1:38pm UTC](https://discuss.elastic.co/t/alert-query-to-get-distinct-count/287583/1 "2021-10-25T13:38:06Z")

</div>

```auto
log : 1
{
  "_index": "some index",
  "fields": {
    "PARTITION": [
      4
    ],
    "APPLICATION_NAME": [
      "order-app"
    ],
  }
}
-----
log : 2
{
  "_index": "some index",
  "fields": {
    "PARTITION": [
      3
    ],
    "APPLICATION_NAME": [
      "order-app"
    ],
  }
}
-----
log : 3
{
  "_index": "some index",
  "fields": {
    "PARTITION": [
      2
    ],
    "APPLICATION_NAME": [
      "order-app"
    ],
  }
}

```

I have compiled some examples of my logs in which PARTITION being indexed as integer in Elasticsearch.  
The PARTITION value ranges from 0 through 9.  
Problem:  
Through Rules & Alerts I have to search for the APPLICATION\_NAME='order-app' and PARTITION \>=0 AND PARTITION \<=9  
then get the distinct PARTITION value counts, if the count is less than 6 then send an alert.

Is this possible through Alert Query? If so can I get a help to construct the query?

---

<div class="post-metadata">

**Author:** ![fredrick.bb](https://avatars.discourse-cdn.com/v4/letter/f/7bcc69/32.png) [@fredrick.bb](https://discuss.elastic.co/u/fredrick.bb)\
**Post date:** [October 27, 2021, 3:44pm UTC](https://discuss.elastic.co/t/alert-query-to-get-distinct-count/287583/2 "2021-10-27T15:44:09Z")

</div>

@kibanaquery Can I get a help?

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [October 27, 2021, 5:13pm UTC](https://discuss.elastic.co/t/alert-query-to-get-distinct-count/287583/3 "2021-10-27T17:13:58Z")

</div>

@Patrick_Mueller can u shed some light on this discuss please?

Thank you

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [October 27, 2021, 6:13pm UTC](https://discuss.elastic.co/t/alert-query-to-get-distinct-count/287583/4 "2021-10-27T18:13:25Z")

</div>

This might be possible with the [elasticsearch query rule type](https://www.elastic.co/guide/en/kibana/current/rule-type-es-query.html). It lets you define the query to run, and then set a threshold on the number of matching documents.

The trick would be to find a query that can be used to either produce a document per partition value, in which case the threshold would be 6. Off the top of my head, not sure how to do that. I can think of some ways to get this via aggregations, but currently the Elasticsearch query rule doesn't support aggregations.

In lieu of that, you could try looking at [a rollup or transform of that index, on the elasticsearch side](https://www.elastic.co/guide/en/elasticsearch/reference/current/data-rollup-transform.html). The idea would be to generate a new index with the summary of the data, at some interval. This could be useful in other ways, as you could then easily track the number of distinct partitions over time. You should be able to easily use the Elasticsearch query rule type with that, and perhaps some of the other rules like metrics threshold.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2021, 6:13pm UTC](https://discuss.elastic.co/t/alert-query-to-get-distinct-count/287583/5 "2021-11-24T18:13:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.