# Alerts in a cluster
**URL:** https://discuss.elastic.co/t/alerts-in-a-cluster/330203
**Category:** Kibana
**Created:** [April 18, 2023, 8:34am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203 "2023-04-18T08:34:36Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 8:34am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/1 "2023-04-18T08:34:36Z")
Is it possible to create a cluster and each node configure rules and when an alert is heard in a node, this alert is replicated to a master node? But I didn't want alerts from other nodes or master's alerts to be replicated to other nodes. I want the nodes to only communicate alerts to the master node, I'm trying to do this with elasticsearch on premises.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 18, 2023, 8:42am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/2 "2023-04-18T08:42:44Z")
Welcome to our community! 😃
That's not possible as alerts are managed at a cluster level, even if only a single node actions it. Can you elaborate why you want this?
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 8:56am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/3 "2023-04-18T08:56:50Z")
I have a company and I wanted to install an elasticsearch on all clients, but I wanted all elasticsearch to be connected to another elastic so that I could manage it better. But the alerts from each elasticsearch could not mix.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 18, 2023, 9:19am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/4 "2023-04-18T09:19:30Z")
Unfortunately Elasticsearch is not architected like that.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 9:36am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/5 "2023-04-18T09:36:21Z")
Is there any way to install a cluster and each node is a client and each node has its own alerts?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 18, 2023, 9:48am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/6 "2023-04-18T09:48:06Z")
Nope.
You could use [Search across clusters | Elasticsearch Guide [8.7] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/modules-cross-cluster-search.html) from a single "main" cluster.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 9:54am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/7 "2023-04-18T09:54:09Z")
Isn't there a way that I have only one cluster?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 18, 2023, 10:18am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/8 "2023-04-18T10:18:44Z")
Not really, no.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 11:32am UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/9 "2023-04-18T11:32:03Z")
How across clusters solve my problem ?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 1:22pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/10 "2023-04-18T13:22:45Z")
> [@Joelgoncalves3000](#):
>
> How across clusters solve my problem ?
It won't solve, but cross cluster search enables you to search on multiple different elasticsearch cluster from one central elasticsearch cluster.
There is nothing that would enables you to manage different clusters from a central cluster, it was not designed to work like this, so what you want to do is not possible.
However, if you are talking about Kibana Alerts, them you may use Spaces so each client will only see its own alerts, if you have multiple tenants (clients) you should already be using Spaces.
Kibana Alerts are per space, so if a Client on space A creates an alert, this will only show up on the space A.
> [@Joelgoncalves3000](#):
>
> I have a company and I wanted to install an elasticsearch on all clients, but I wanted all elasticsearch to be connected to another elastic so that I could manage it better. But the alerts from each elasticsearch could not mix.
Not sure what you are trying to implement, but I recommend that you check the Elastic license with your legal team to see if what you are trying to implement is allowed.
From what I understood you are offering Elasticsearch as a managed service, and according to the [license](https://www.elastic.co/pricing/faq/licensing#key-changes) this is not allowed.
> - You may not provide the products to others as a managed service
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 1:28pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/11 "2023-04-18T13:28:50Z")
If I have several elasticsearchs and want to connect them to a kibana and assign a space to each elasticsearch, will the kibana alerts be different?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 1:34pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/12 "2023-04-18T13:34:49Z")
> [@Joelgoncalves3000](#):
>
> If I have several elasticsearchs and want to connect them to a kibana and assign a space to each elasticsearch, will the kibana alerts be different?
No, this is not possible, elasticsearch was not designed to work like this, Kibana will only connect to **one** cluster, you can't connect Kibana to multiple clusters.
If you have multiple elasticsearch clusters each one of them will need a Kibana and you will need to access each Kibana if you want to manage the cluster.
It is not possible to **manage** multiple clusters from a central location, you can only search on them or replicate the data if you have a paid license, but all the manage actions are done per cluster.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 1:40pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/13 "2023-04-18T13:40:50Z")
I'm talking about a cluster. Is it possible to connect a cluster with several nodes and assign a space per node and each space in kibana says the alerts of that node?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 1:49pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/14 "2023-04-18T13:49:45Z")
> [@Joelgoncalves3000](#):
>
> I'm talking about a cluster. Is it possible to connect a cluster with several nodes and assign a space per node and each space in kibana says the alerts of that node?
Spaces are a Kibana feature, it was designed to help you organize your data views, dashboards, alerts etc.
The data from spaces are stored in system indices that you should not worry about them, it is created and managed by Kibana, where they are going to be stored should not be an issue.
Also, Kibana can connects to only **one** node at time, so if you have multiple clients, every one will use the same Kibana that will be connected to the same Elasticsearch node, you should however configure the permissions of each client to access only its indices and see only its own space, you can read more about spaces in the [documentation](https://www.elastic.co/guide/en/kibana/current/xpack-spaces.html).
It is not clear what kind of alerts you are talking about, Kibana [alerts](https://www.elastic.co/guide/en/kibana/current/alerting-getting-started.html) are alerts created based on the **data** you have in your cluster, it doesn't matter in which node the data is stored.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 1:53pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/15 "2023-04-18T13:53:54Z")
I have a cluster with several clients and I want each client to have its own space and I can only see the alerts from its node. I'm talking about the alerts that are in the security tab.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 2:06pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/16 "2023-04-18T14:06:10Z")
> [@Joelgoncalves3000](#):
>
> I have a cluster with several clients and I want each client to have its own space and I can only see the alerts from its node. I'm talking about the alerts that are in the security tab.
You can, you will need to create an space for each Client, and using this space your client will be able to create alerts on the data they have access, this alert will only be present in the space where it was created.
But as I said, the node does not matter, what matter is the data the client has access.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 2:09pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/17 "2023-04-18T14:09:59Z")
For example, if I have packekbeat installed by each client and assign a space to each client, will the data I receive from packetbeat go to that space? And how do you assign a customer to a space?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 2:23pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/18 "2023-04-18T14:23:33Z")
> [@Joelgoncalves3000](#):
>
> For example, if I have packekbeat installed by each client and assign a space to each client, will the data I receive from packetbeat go to that space?
As I said, spaces are a Kibana feature, they only exist in Kibana, your data won't go to any space, they will go into indices.
In each spaces you will configure the data views for the indices you want to show in that space, and in the user roles you assign the indices that the user can see and the spaces it can access.
I suggest that you read the [role management documentation](https://www.elastic.co/guide/en/kibana/current/kibana-role-management.html) and the [spaces documentation](https://www.elastic.co/guide/en/kibana/current/xpack-spaces.html).
Another thing is, if you are installing one packetbeat per client you will need to edit the name of the indice that packetbeat (or any other beat) will use, if you use the default indice name all your clients will see all the data.
---
### Author:  [@Joelgoncalves3000](https://discuss.elastic.co/u/Joelgoncalves3000)
#### Post date: [April 18, 2023, 2:27pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/19 "2023-04-18T14:27:36Z")
If everything goes to an index, how do I filter the client's information later?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [April 18, 2023, 2:36pm UTC](https://discuss.elastic.co/t/alerts-in-a-cluster/330203/20 "2023-04-18T14:36:08Z")
> [@Joelgoncalves3000](#):
>
> If everything goes to an index, how do I filter the client's information later?
When you create a role you specify which indices each role can access, this is explained in the role management documentation linked above.
If this will work for you depends on how you are organizing your data in the indices, if you have multiple clients you have basically two options:
- Use indices per client, something like `clientName-indiceName-*`, then in the role for this client you will give access to all indices starting with `clientName-*`.
- Use document level security, but this is more complex and it is a **paid feature** , so it doesn't work with the basic free license.
Please read the linked documentation from the previous posts.
Also, you didn't provide any information about what kind of service you are providing to your clients and how you are providing it, I would suggest that you open a new topic if you have more questions about it, also, check the Elastic license to see if what you are doing is allowed.
[Next page](https://discuss.elastic.co/t/alerts-in-a-cluster/330203.md?page=2)