# Alerts are sometimes triggered

**URL:** <https://discuss.elastic.co/t/alerts-are-sometimes-triggered/284723>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [September 21, 2021, 12:27pm UTC](https://discuss.elastic.co/t/alerts-are-sometimes-triggered/284723 "2021-09-21T12:27:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mar-ro](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@mar-ro](https://discuss.elastic.co/u/mar-ro)\
**Post date:** [September 21, 2021, 12:27pm UTC](https://discuss.elastic.co/t/alerts-are-sometimes-triggered/284723/1 "2021-09-21T12:27:56Z")

</div>

Hi all.

After configuring some alerts on the different logs shown in the "Observability \> Logs \> Steam" menu, I don't understand why the emails are not sent every time the term that should trigger the alert is found among those logs.

For example, if I search for the word "ERROR" in the last 5 minutes I see that there is a match, so I artificially generate errors every minute to check if the alert is triggered correctly, but it is only launched the first time, the rest of the times the email is not sent, so I receive only one email, and not one every time an error is generated.

The current alert configuration is as shown below:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/027ad3508b4fe82e5aa2d167df75a2ae8afcf36a.png)

Is there something I am doing wrong, why is the email only sent once and not every time the word "error" is encountered in the logs?

Thank you!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 22, 2021, 6:20am UTC](https://discuss.elastic.co/t/alerts-are-sometimes-triggered/284723/2 "2021-09-22T06:20:25Z")

</div>

Where it's says Notify setting.

And you have

`Only on status change`

That is why you are most likely only getting alerted once That is the intention of that.

Take a look [here](https://www.elastic.co/guide/en/kibana/7.14/create-and-manage-rules.html) at the **Notify** Section

---

<div class="post-metadata">

**Author:** ![mar-ro](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@mar-ro](https://discuss.elastic.co/u/mar-ro)\
**Post date:** [September 22, 2021, 6:52am UTC](https://discuss.elastic.co/t/alerts-are-sometimes-triggered/284723/3 "2021-09-22T06:52:03Z")

</div>

Thank you !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2021, 6:52am UTC](https://discuss.elastic.co/t/alerts-are-sometimes-triggered/284723/4 "2021-10-20T06:52:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.