# Alerts and actions filters

**URL:** <https://discuss.elastic.co/t/alerts-and-actions-filters/246688>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [August 27, 2020, 9:14pm UTC](https://discuss.elastic.co/t/alerts-and-actions-filters/246688 "2020-08-27T21:14:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sfenman](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@sfenman](https://discuss.elastic.co/u/sfenman)\
**Post date:** [August 27, 2020, 9:14pm UTC](https://discuss.elastic.co/t/alerts-and-actions-filters/246688/1 "2020-08-27T21:14:43Z")

</div>

Hello,

I am using Elastic stack version 7.9. I am trying to use alerts and actions instead of watcher for my various alerts. Is it possible to filter out some documents? The only options I got is to create an alert for "all documents" or for "top documents".

Also, in the same context, I am trying to use alerts for my APM instances for transaction duration. I got two applications using the same APM index. Does alerting distinguish the duration fields between my two different applications?

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [August 31, 2020, 5:25pm UTC](https://discuss.elastic.co/t/alerts-and-actions-filters/246688/2 "2020-08-31T17:25:02Z")

</div>

Have you tried to use a different alert templates, like the log threshold?  
This seems to provide more options to filter your documents as you prefer

 ![Screenshot 2020-08-31 at 19.24.17](https://us1.discourse-cdn.com/elastic/original/3X/f/a/fa18abbf2c3d4496f3f1aacb26a2869b77c1554b.png)

---

<div class="post-metadata">

**Author:** ![sfenman](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@sfenman](https://discuss.elastic.co/u/sfenman)\
**Post date:** [September 1, 2020, 7:32am UTC](https://discuss.elastic.co/t/alerts-and-actions-filters/246688/3 "2020-09-01T07:32:17Z")

</div>

Thanks for the suggestion. It would be nice if I could use more comparison operators like

`WITH duration MORE THAN 300`

It solved some of my cases though, thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2020, 7:32am UTC](https://discuss.elastic.co/t/alerts-and-actions-filters/246688/4 "2020-09-29T07:32:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.