# Complicated filter/aggregation based on an ID excluding CREARED from REVIEVED alerts
**URL:** https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882
**Category:** Kibana
**Created:** [November 30, 2015, 10:46am UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882 "2015-11-30T10:46:33Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@NilsBecker](https://discuss.elastic.co/u/NilsBecker)
#### Post date: [November 30, 2015, 10:46am UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882/1 "2015-11-30T10:46:33Z")
Hey,
I have following issue:
I recieve "alert-logs" from an monitoring-tool (Tibco Hawk)
There are the fields:
- **event** _[ALERT\_RECIEVED, ALERT\_CLEARED]_
- **alert\_id** _[unique ID for every alert]_
- more things like IP, Timestamp, ...
So i could get
{"event":" **ALERT\_RECIEVED**", "alert\_id":" **001**", ...}
{"event":"ALERT\_RECIEVED", "alert\_id":"002", ...}
{"event":" **ALERT\_RECIEVED**", "alert\_id":" **001**", ...}
{"event":"ALERT\_RECIEVED", "alert\_id":"003", ...}
{"event":" **ALERT\_CLEARED**", "alert\_id":" **001**", ...}
Now I want a metric to count all active (not cleared) alerts.
I must select all ALERT\_RECIEVED and deselect all of them with the alert\_ids of all ALERT\_CLEARED
So the correct count for my example would be: **2** _(002, 003)_
And I have no idea how to do that... please help.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 30, 2015, 12:03pm UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882/2 "2015-11-30T12:03:20Z")
The most performant and scalable way to do this is possibly through a separate entity-centric alert index. Please see [this post](https://discuss.elastic.co/t/bucket-selector-aggregation-script-access-doc-index-field-value/35516) for further details with respect to a seemingly very similar scenario.
---
### Author:  [@NilsBecker](https://discuss.elastic.co/u/NilsBecker)
#### Post date: [December 1, 2015, 7:08am UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882/3 "2015-12-01T07:08:52Z")
I have used [this solution](https://discuss.elastic.co/t/kibana-charts-with-only-latest-entry/32423/3?u=nilsbecker) for another visualization but here I can't.
In my example you can see more than one alert can have the same ALERT\_ID (because the same "Rule" caused the errors).
If I use the ALERT\_ID as ID in Elasticsearch, I'm not abel to see all alerts.
And in want to see all alerts, also the allready cleared in a visualization which showas how many alerts I had in the last few hours/days (Line chart).
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 1, 2015, 7:44am UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882/4 "2015-12-01T07:44:39Z")
You can probably still solve this with an entity-centric index, but instead of just storing the latest document received, you may need to update the entity-centric document instead in order to keep track of the number of received and cleared alerts.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:07pm UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882/5 "2017-07-06T14:07:49Z")