# Create Alerting in Kibana using API

**URL:** <https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 12, 2020, 2:14pm UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221 "2020-11-12T14:14:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Baptiste\_Orsoni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baptiste_orsoni/32/45225_2.png) [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\
**Post date:** [November 12, 2020, 2:14pm UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221/1 "2020-11-12T14:14:26Z")

</div>

Hello,

I would like to know if it is possible to create alerts with the Elastic Search API. Let me explain;

I have a script below that sends me the traffic of a client during the last 5 minutes:

```auto
    GET /app-sms-smpp-serversmpp-prd-7.4.2-2020.11.10/_search
    {
      "query": {
        "bool": {
          "must": [
          {
            "term": {
              "smpp.serversmpp.data.client": {
              "value": "KDEV"
              }
            }
          },
          {
            "range": {
              "@timestamp": {
                "from": "now-5m/m", 
                "to": "now/s"
              }
            }
          }
          ]
        } 
      }
    }

```

I would like to know if it was possible to create an alert (email for example) that would be triggered when the number of hits for this client during the last 5 minutes is zero for example.

Thank you very much in advance for your help.

Best regards,

Baptiste

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [November 12, 2020, 5:04pm UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221/2 "2020-11-12T17:04:19Z")

</div>

Hello @Baptiste_Orsoni

Yes, this is possible with Watcher. Here are the elasticsearch docs - [https://www.elastic.co/guide/en/elasticsearch/reference/7.10/how-watcher-works.html#watch-definition](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/how-watcher-works.html#watch-definition)

and the Kibana docs, if you wish to use a UI at some point - [https://www.elastic.co/guide/en/kibana/current/watcher-ui.html](https://www.elastic.co/guide/en/kibana/current/watcher-ui.html)

Thanks,  
Matt

---

<div class="post-metadata">

**Author:** ![Baptiste\_Orsoni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baptiste_orsoni/32/45225_2.png) [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\
**Post date:** [November 13, 2020, 2:14pm UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221/3 "2020-11-13T14:14:14Z")

</div>

Hello @mattkime,

Thank you very much for your answer. I can see that Watcher is available only from the gold license.

We're using a free license, is there still a way to do what I want to do using the API ?

Thank you in advance for your help.

Baptiste

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [November 13, 2020, 2:24pm UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221/4 "2020-11-13T14:24:00Z")

</div>

Unfortunately not, but you could try a trial license to determine if the feature would be worthwhile for you.

---

<div class="post-metadata">

**Author:** ![Baptiste\_Orsoni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baptiste_orsoni/32/45225_2.png) [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\
**Post date:** [November 13, 2020, 2:36pm UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221/5 "2020-11-13T14:36:30Z")

</div>

But I can see that Kibana alerting and actions are available for basics versions:

 ![alertings_kibana](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a6144259e0c7746bc913cdf1a5ac578ab38faf83.png)

Can it be accessed? If so, can this feature meet my needs listed above?

What about the `anomaly detection jobs` ? Could it work ? Is it available on the free version ?

Thanks for your help

---

<div class="post-metadata">

**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\
**Post date:** [November 14, 2020, 2:53am UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221/6 "2020-11-14T02:53:55Z")

</div>

@Baptiste_Orsoni

You're correct, Kibana alerts might be worthwhile. This explains the differences between watcher and alerts - [https://www.elastic.co/guide/en/kibana/7.x/alerting-getting-started.html#alerting-concepts-differences](https://www.elastic.co/guide/en/kibana/7.x/alerting-getting-started.html#alerting-concepts-differences)

It looks like `Anomaly detection on time series` requires a platinum or enterprise license - [https://www.elastic.co/pricing](https://www.elastic.co/pricing)

Thanks,  
Matt

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2020, 2:53am UTC](https://discuss.elastic.co/t/create-alerting-in-kibana-using-api/255221/7 "2020-12-12T02:53:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.