# Alerts from Kibana/ES

**URL:** https://discuss.elastic.co/t/alerts-from-kibana-es/17746
**Category:** Elasticsearch
**Created:** [May 27, 2014, 9:02am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746 "2014-05-27T09:02:35Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![NF1](https://avatars.discourse-cdn.com/v4/letter/n/7bcc69/32.png) [@NF1](https://discuss.elastic.co/u/NF1)
#### Post date: [May 27, 2014, 9:02am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/1 "2014-05-27T09:02:35Z")

</div>

Hi,

We’re using Kibana/Elasticsearch to visualize different kind of logs in our  
company. Now, we would need a feature that would allow us to send an  
alert/notification (email or other) when a certain event/trigger is  
captured.

I’d like to know if in Kibana/Elasticsearch backlog there is such a feature  
planned? If so, when might we expect it available?

If not, could you please suggest any (open source) solution to satisfy our  
need?

Thanks,

Natalia

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![Norberto\_Meijome](https://avatars.discourse-cdn.com/v4/letter/n/ed655f/32.png) [@Norberto\_Meijome](https://discuss.elastic.co/u/Norberto_Meijome)
#### Post date: [May 27, 2014, 9:11am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/2 "2014-05-27T09:11:24Z")

</div>

Hi, not sure tbh  
Kibana is a js interface so I don't think it makes sense to alert from it.  
You could monitor the results stored in ES with nagios/zabbix/ your  
monitoring of choice and parse the json result and alert based on that.  
We've used logstash's statsd module to send data we are interested - we  
have standard checks against a lot of statsd data points so this was a  
simple way to integrate it all.  
On 27/05/2014 7:02 pm, "NF" [natalia.filipiak@gmail.com](mailto:natalia.filipiak@gmail.com) wrote:

> Hi,
> 
> We’re using Kibana/Elasticsearch to visualize different kind of logs in  
> our company. Now, we would need a feature that would allow us to send an  
> alert/notification (email or other) when a certain event/trigger is  
> captured.
> 
> I’d like to know if in Kibana/Elasticsearch backlog there is such a  
> feature planned? If so, when might we expect it available?
> 
> If not, could you please suggest any (open source) solution to satisfy our  
> need?
> 
> Thanks,
> 
> Natalia
> 
> --  
> You received this message because you are subscribed to the Google Groups  
> "elasticsearch" group.  
> To unsubscribe from this group and stop receiving emails from it, send an  
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
> To view this discussion on the web visit  
> [https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/0107a345-9eb2-431f-8639-3bcc526dbaea%40googlegroups.com?utm_medium=email&utm_source=footer)  
> .  
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CACj2-4JgG9Ub%2BaNdQt\_e97n9N37pSgDv4z1nCfhZtDAkYMe1zQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CACj2-4JgG9Ub%2BaNdQt_e97n9N37pSgDv4z1nCfhZtDAkYMe1zQ%40mail.gmail.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![elvarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elvarb/32/44840_2.png) [@elvarb](https://discuss.elastic.co/u/elvarb)
#### Post date: [May 27, 2014, 10:12am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/3 "2014-05-27T10:12:50Z")

</div>

Use this input filter in Logstash to search the logs

> **[Elasticsearch input plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html)**

On Tuesday, May 27, 2014 9:02:35 AM UTC, NF wrote:

> Hi,
> 
> We’re using Kibana/Elasticsearch to visualize different kind of logs in  
> our company. Now, we would need a feature that would allow us to send an  
> alert/notification (email or other) when a certain event/trigger is  
> captured.
> 
> I’d like to know if in Kibana/Elasticsearch backlog there is such a  
> feature planned? If so, when might we expect it available?
> 
> If not, could you please suggest any (open source) solution to satisfy our  
> need?
> 
> Thanks,
> 
> Natalia

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/cef00f3f-1e7d-44be-9af8-6e963d1e8c24%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cef00f3f-1e7d-44be-9af8-6e963d1e8c24%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)
#### Post date: [May 30, 2014, 5:20am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/4 "2014-05-30T05:20:27Z")

</div>

Hi,

There's no alerting in Kibana. Have a look at SPM  
[http://sematext.com/spm/](http://sematext.com/spm/) - it has ES monitoring, threshold and heartbeat  
alerting, anomaly detection, and a number of other features. Actually,  
re-reading your email - you are looking to get notified when a certain  
event is captured? By that do you mean having something like a "saved  
query" that matches incoming logs?

## Otis

Performance Monitoring \* Log Analytics \* Search Analytics  
Solr & Elasticsearch Support \* [http://sematext.com/](http://sematext.com/)

On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:

> Hi,
> 
> We’re using Kibana/Elasticsearch to visualize different kind of logs in  
> our company. Now, we would need a feature that would allow us to send an  
> alert/notification (email or other) when a certain event/trigger is  
> captured.
> 
> I’d like to know if in Kibana/Elasticsearch backlog there is such a  
> feature planned? If so, when might we expect it available?
> 
> If not, could you please suggest any (open source) solution to satisfy our  
> need?
> 
> Thanks,
> 
> Natalia

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8e0028e1-aa1a-44ae-bd7a-e4364827076f%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8e0028e1-aa1a-44ae-bd7a-e4364827076f%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![NF1](https://avatars.discourse-cdn.com/v4/letter/n/7bcc69/32.png) [@NF1](https://discuss.elastic.co/u/NF1)
#### Post date: [May 30, 2014, 6:31am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/5 "2014-05-30T06:31:06Z")

</div>

That's right, Otis.

On Friday, May 30, 2014 7:20:27 AM UTC+2, Otis Gospodnetic wrote:

> Hi,
> 
> There's no alerting in Kibana. Have a look at SPM  
> [http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ](http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ)
> 
> - it has ES monitoring, threshold and heartbeat alerting, anomaly  
> detection, and a number of other features. Actually, re-reading your email
> - you are looking to get notified when a certain event is captured? By  
> that do you mean having something like a "saved query" that matches  
> incoming logs?
> 
> ## Otis
> 
> Performance Monitoring \* Log Analytics \* Search Analytics  
> Solr & Elasticsearch Support \* [http://sematext.com/](http://sematext.com/)
> 
> On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:
> 
> > Hi,
> > 
> > We’re using Kibana/Elasticsearch to visualize different kind of logs in  
> > our company. Now, we would need a feature that would allow us to send an  
> > alert/notification (email or other) when a certain event/trigger is  
> > captured.
> > 
> > I’d like to know if in Kibana/Elasticsearch backlog there is such a  
> > feature planned? If so, when might we expect it available?
> > 
> > If not, could you please suggest any (open source) solution to satisfy  
> > our need?
> > 
> > Thanks,
> > 
> > Natalia

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/ed8a472c-6033-4f85-a97e-d3c81c3b30a9%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/ed8a472c-6033-4f85-a97e-d3c81c3b30a9%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![german23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/german23/32/11052_2.png) [@german23](https://discuss.elastic.co/u/german23)
#### Post date: [June 2, 2014, 6:00am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/6 "2014-06-02T06:00:04Z")

</div>

Hi NF,

we did also set up alerting with our zabbix-monitoring-system.

What we use are simple Linux-Scripts using the command "curl" to search in  
given elasticsearch-indices.

In the zabbix-system are build triggers that are runs the script on our  
elasticsearch-server and interpret the output given from this scripts (e.g.  
Number of events with ID 4625) and if this value is a specific value the  
trigger alerts.

It´s simple to set up and maybe this is what you are looking for.

If you need any help, feel free to contact me

Am Freitag, 30. Mai 2014 08:31:07 UTC+2 schrieb NF:

> That's right, Otis.
> 
> On Friday, May 30, 2014 7:20:27 AM UTC+2, Otis Gospodnetic wrote:
> 
> > Hi,
> > 
> > There's no alerting in Kibana. Have a look at SPM  
> > [http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ](http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ)
> > 
> > - it has ES monitoring, threshold and heartbeat alerting, anomaly  
> > detection, and a number of other features. Actually, re-reading your email
> > - you are looking to get notified when a certain event is captured? By  
> > that do you mean having something like a "saved query" that matches  
> > incoming logs?
> > 
> > ## Otis
> > 
> > Performance Monitoring \* Log Analytics \* Search Analytics  
> > Solr & Elasticsearch Support \* [http://sematext.com/](http://sematext.com/)
> > 
> > On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:
> > 
> > > Hi,
> > > 
> > > We’re using Kibana/Elasticsearch to visualize different kind of logs in  
> > > our company. Now, we would need a feature that would allow us to send an  
> > > alert/notification (email or other) when a certain event/trigger is  
> > > captured.
> > > 
> > > I’d like to know if in Kibana/Elasticsearch backlog there is such a  
> > > feature planned? If so, when might we expect it available?
> > > 
> > > If not, could you please suggest any (open source) solution to satisfy  
> > > our need?
> > > 
> > > Thanks,
> > > 
> > > Natalia

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b6c9170f-ad81-4d92-94d5-424389e817c8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b6c9170f-ad81-4d92-94d5-424389e817c8%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)
#### Post date: [June 2, 2014, 8:45pm UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/7 "2014-06-02T20:45:33Z")

</div>

Aha. FWIW, such "saved queries" functionality is being added to Logsene  
[http://sematext.com/logsene/](http://sematext.com/logsene/) as I type. Logsene is currently free if you  
want to play around with it. No such thing in Kibana, but of course there  
is Percolator.

## Otis

Performance Monitoring \* Log Analytics \* Search Analytics  
Solr & Elasticsearch Support \* [http://sematext.com/](http://sematext.com/)

tel: +1 347 480 1610 fax: +1 718 679 9190

On Friday, May 30, 2014 2:31:07 AM UTC-4, NF wrote:

> That's right, Otis.
> 
> On Friday, May 30, 2014 7:20:27 AM UTC+2, Otis Gospodnetic wrote:
> 
> > Hi,
> > 
> > There's no alerting in Kibana. Have a look at SPM  
> > [http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ](http://www.google.com/url?q=http%3A%2F%2Fsematext.com%2Fspm%2F&sa=D&sntz=1&usg=AFQjCNEYpqf7mA9CH122rtdZ0CJtqY3bFQ)
> > 
> > - it has ES monitoring, threshold and heartbeat alerting, anomaly  
> > detection, and a number of other features. Actually, re-reading your email
> > - you are looking to get notified when a certain event is captured? By  
> > that do you mean having something like a "saved query" that matches  
> > incoming logs?
> > 
> > ## Otis
> > 
> > Performance Monitoring \* Log Analytics \* Search Analytics  
> > Solr & Elasticsearch Support \* [http://sematext.com/](http://sematext.com/)
> > 
> > On Tuesday, May 27, 2014 5:02:35 AM UTC-4, NF wrote:
> > 
> > > Hi,
> > > 
> > > We’re using Kibana/Elasticsearch to visualize different kind of logs in  
> > > our company. Now, we would need a feature that would allow us to send an  
> > > alert/notification (email or other) when a certain event/trigger is  
> > > captured.
> > > 
> > > I’d like to know if in Kibana/Elasticsearch backlog there is such a  
> > > feature planned? If so, when might we expect it available?
> > > 
> > > If not, could you please suggest any (open source) solution to satisfy  
> > > our need?
> > > 
> > > Thanks,
> > > 
> > > Natalia

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/bad95114-98e1-4704-9f8c-9b98c3c72ffb%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bad95114-98e1-4704-9f8c-9b98c3c72ffb%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:25am UTC](https://discuss.elastic.co/t/alerts-from-kibana-es/17746/8 "2017-07-06T01:25:10Z")

</div>


