# Create Alert using connector Index

**URL:** <https://discuss.elastic.co/t/create-alert-using-connector-index/293324>\
**Category:** Elastic Security\
**Created:** [January 3, 2022, 8:04am UTC](https://discuss.elastic.co/t/create-alert-using-connector-index/293324 "2022-01-03T08:04:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alipujaistopo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alipujaistopo/32/50791_2.png) [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\
**Post date:** [January 3, 2022, 8:04am UTC](https://discuss.elastic.co/t/create-alert-using-connector-index/293324/1 "2022-01-03T08:04:27Z")

</div>

hello everyone, i wanna create alert ssh bruteforce but using "index" connector. because i dunno what index i will use and i dunno how to test it.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d161cb80ebbaf45eeefc403f302f7f671f7436a2.png)

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [January 7, 2022, 5:44pm UTC](https://discuss.elastic.co/t/create-alert-using-connector-index/293324/2 "2022-01-07T17:44:08Z")

</div>

Hey there @alipujaistopo 👋

I'm not sure I fully understand what you mean by ` i dunno what index i will use`? Do you mean that you want to programmatically pick what index you write to based on data within the action context itself? If so, that is not currently possible, and you must specify the destination index when setting up the action, but please feel free to [open a feature request](https://github.com/elastic/kibana/issues/new?assignees=&labels=&template=Feature_request.md) detailing your use case so we can capture it.

If you do know the index you want to write data to, you can check out the [Index Action documentation](https://www.elastic.co/guide/en/kibana/current/index-action-type.html) for details on configuring and testing the connector/action. And here's the [pull request](https://github.com/elastic/kibana/pull/111813) where this functionality was added for additional details.

Please note that there is [currently a limitation](https://github.com/elastic/kibana/issues/89430) with the Index Action in that it [cannot index multiple documents](https://github.com/elastic/kibana/issues/110550#issuecomment-916524090) per action firing, so it's mostly useful at this moment for writing aggregate alert data instead of forwarding raw alerts to another index. Often times though you should be able to just reference the raw alerts in the `.siem-signals` index directly.

Hope this help, and let us know if you have any additional questions -- cheers!  
Garrett

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2022, 5:44pm UTC](https://discuss.elastic.co/t/create-alert-using-connector-index/293324/3 "2022-02-04T17:44:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.