# Alerting Feature

**URL:** <https://discuss.elastic.co/t/alerting-feature/270981>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [April 22, 2021, 3:38pm UTC](https://discuss.elastic.co/t/alerting-feature/270981 "2021-04-22T15:38:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Coyz](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Coyz](https://discuss.elastic.co/u/Coyz)\
**Post date:** [April 22, 2021, 3:38pm UTC](https://discuss.elastic.co/t/alerting-feature/270981/1 "2021-04-22T15:38:22Z")

</div>

Hi,

I would like to alert by mail when a specific term appeared on a index.

Example for windows event log

- event.id: 4770

I don't think it's possible right now ? Is there any plan to support that features ?

Thanks

---

<div class="post-metadata">

**Author:** ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)\
**Post date:** [April 22, 2021, 5:07pm UTC](https://discuss.elastic.co/t/alerting-feature/270981/2 "2021-04-22T17:07:47Z")

</div>

It is possible using the Log threshold alert type. But to send a Mail you need to Switch to a gold license First

---

<div class="post-metadata">

**Author:** ![Coyz](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Coyz](https://discuss.elastic.co/u/Coyz)\
**Post date:** [April 23, 2021, 9:36am UTC](https://discuss.elastic.co/t/alerting-feature/270981/3 "2021-04-23T09:36:20Z")

</div>

You are right, i need first to change the index in Observability =\> Log =\> Settings

I put ecs-\* on index settings, so i cannot specify and specific index for an alert log ?

I have a lot of index type behind ecs-, i'm affraid it can affect elasticsearch performance

Thanks

---

<div class="post-metadata">

**Author:** ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)\
**Post date:** [April 23, 2021, 10:06am UTC](https://discuss.elastic.co/t/alerting-feature/270981/4 "2021-04-23T10:06:23Z")

</div>

Using index threshold you can configure the index directly in the alert.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5ddc4c9225344c1420907ece25bba57f7ad599d1.png)

---

<div class="post-metadata">

**Author:** ![Coyz](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Coyz](https://discuss.elastic.co/u/Coyz)\
**Post date:** [April 23, 2021, 11:45am UTC](https://discuss.elastic.co/t/alerting-feature/270981/5 "2021-04-23T11:45:47Z")

</div>

I'm in 7.11.1 so Index threshold don't look what i need (send an alert for a specific event).

But it in 7.12 there is a new feature called "Elasticsearch query alert" [What’s new in 7.12 | Kibana Guide [7.12] | Elastic](https://www.elastic.co/guide/en/kibana/current/whats-new.html#alerting-7-12) and it's look like this feature matches my needs

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2021, 11:46am UTC](https://discuss.elastic.co/t/alerting-feature/270981/6 "2021-05-21T11:46:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.