# Alerting In AWS Elasticsearch Kibana

**URL:** <https://discuss.elastic.co/t/alerting-in-aws-elasticsearch-kibana/251127>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting\
**Created:** [October 6, 2020, 1:02pm UTC](https://discuss.elastic.co/t/alerting-in-aws-elasticsearch-kibana/251127 "2020-10-06T13:02:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kennedy](https://avatars.discourse-cdn.com/v4/letter/k/c0e974/32.png) [@kennedy](https://discuss.elastic.co/u/kennedy)\
**Post date:** [October 6, 2020, 1:02pm UTC](https://discuss.elastic.co/t/alerting-in-aws-elasticsearch-kibana/251127/1 "2020-10-06T13:02:06Z")

</div>

Hi Everyone,

So here is the scenario , I have metricbeat installed on 2 different servers. The feed is going from the logstash to the AWS Elasticsearch. Now , I'm setting up the alerting in kibana for cpu utilization.

{ "query":  
{"bool":  
{"must":  
[{"range":  
{"system.memory.actual.used.pct": {"gte": 0.5}}},  
{"range":  
{"@timestamp":  
{"gte": "now-1h","lte": "now/m"}}}]  
}  
}}

now the alert is triggering but one for one host. Though the condition is satisfied for both meaning the alert should trigger for both separately.  
So that in case there are 5 servers with metric beat and over the threshold the alert should come. Any changes to the script or to the trigger part. Please suggest how that can be done.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [October 6, 2020, 1:24pm UTC](https://discuss.elastic.co/t/alerting-in-aws-elasticsearch-kibana/251127/2 "2020-10-06T13:24:08Z")

</div>

We don't support this service here so I'm not sure if we can really help.

BTW did you look at [Cloud by Elastic](https://www.elastic.co/cloud), also available if needed from [AWS Marketplace](https://aws.amazon.com/marketplace/pp/B01N6YCISK) ?

Cloud by elastic is one way to have access to **all features** , all managed by us. Think about what is there yet like Security, Monitoring, Reporting, SQL, Canvas, Maps UI, Alerting and built-in solutions named [Observability](https://www.elastic.co/observability), [Security](https://www.elastic.co/security), [Enterprise Search](https://www.elastic.co/enterprise-search) and what is coming next 🙂 ...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2020, 1:24pm UTC](https://discuss.elastic.co/t/alerting-in-aws-elasticsearch-kibana/251127/3 "2020-11-03T13:24:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.