# Alerts issue

**URL:** <https://discuss.elastic.co/t/alerts-issue/367182>\
**Category:** Kibana\
**Created:** [September 26, 2024, 12:11pm UTC](https://discuss.elastic.co/t/alerts-issue/367182 "2024-09-26T12:11:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tapiojaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tapiojaa/32/134828_2.png) [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\
**Post date:** [September 26, 2024, 12:11pm UTC](https://discuss.elastic.co/t/alerts-issue/367182/1 "2024-09-26T12:11:58Z")

</div>

I'm trying to configure an alert that when certain word is found, email is sent. Email connector is configured and test email works. My rule looks like this:

```auto
{
    "query":{
      "match" : {
        "message": "client unexpectedly closed TCP connection"
      }
    }
  }

```

When I click "Test query" button, it will find documents  
"Query matched 258 documents in the last 3h."

I've scheduled to run query every 5 minutes.

Action is to use Email connector.  
Action frequency: For each alert = On check intervals  
Run when: Query matched  
If alert matches a query option is selected. I wonder what "a customer query is required" warning means! Custom query is defined earlier!!

Then there is email address, subject and message

I can see that rule runs fine, but ít doesn't generate any alerts

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 26, 2024, 10:20pm UTC](https://discuss.elastic.co/t/alerts-issue/367182/2 "2024-09-26T22:20:57Z")

</div>

Hi @tapiojaa

I think you need to share the version you are on then the complete configuration of the alert including the query and screen shots of the configuration and where you are the error.

There is not enough detail for us to help.

---

<div class="post-metadata">

**Author:** ![tapiojaa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tapiojaa/32/134828_2.png) [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\
**Post date:** [September 27, 2024, 11:55am UTC](https://discuss.elastic.co/t/alerts-issue/367182/3 "2024-09-27T11:55:28Z")

</div>

Hi, I figured out what was the issue. Threshold values were too big

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/94eb5c3057368e7db900856d57848c8e7f1b7c0c.png)