# Create alerts in packetbeat monitoring

**URL:** <https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970>\
**Category:** Beats\
**Tags:** elastic-stack-alerting, packetbeat\
**Created:** [February 12, 2019, 7:22am UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970 "2019-02-12T07:22:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Post date:** [February 12, 2019, 7:22am UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/1 "2019-02-12T07:22:06Z")

</div>

I am monitoring packetbeat using xpack. [Monitoring beats](https://www.elastic.co/guide/en/beats/packetbeat/current/monitoring.html),if my packetbeat goe's down i should get notified through mail,how could i create watcher alert in this scenario.

Thanks  
Ramya

---

<div class="post-metadata">

**Author:** ![fkelbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fkelbert/32/35762_2.png) [@fkelbert](https://discuss.elastic.co/u/fkelbert)\
**Post date:** [February 12, 2019, 9:04am UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/2 "2019-02-12T09:04:37Z")

</div>

Hi @RamyaGowda,

You first need to find a condition upon which you want to alert. For example, if you have received less than `n` documents within the last `m` minutes, then an email should be sent.

You will find all technical details, including information on how to send email, in the docs about Watcher: [https://www.elastic.co/guide/en/elastic-stack-overview/current/watcher-getting-started.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/watcher-getting-started.html). Hope this helps!

Florian

---

<div class="post-metadata">

**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Post date:** [February 12, 2019, 10:34am UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/3 "2019-02-12T10:34:58Z")

</div>

Hi @fkelbert

Assume that i have 10 packetbeats running and 2 of them goes down at that time i would like send an alert/notification through mail saying that packetbeat is down in this host(IP address)

so that when i get alerts i can go and check my agents why they are stopped

bellow is the sample data what i have in .monitoring-beats-\* index

```
"_index" : ".monitoring-beats-6-2019.02.12",
"_type" : "doc",
"_id" : "GKAB32gBPlvhczozsqzy",
"_score" : 1.0,
"_source" : {
  "cluster_uuid" : "4u5N-s_6TVKXmCRE6w8ecw",
  "timestamp" : "2019-02-12T00:00:57.070Z",
  "interval_ms" : 60000,
  "type" : "beats_state",
  "source_node" : {
    "uuid" : "6bqfOxWeSS6NHdwhLUH54Q",
    "host" : "x.x.x.x",
    "transport_address" : "localhost:9300",
    "ip" : "localhost",
    "name" : "6bqfOxW",
    "timestamp" : "2019-02-12T00:00:57.070Z"
  },
  "beats_state" : {
    "timestamp" : "2019-02-12T00:00:57.067Z",
    "beat" : {
      "host" : "host1",
      "uuid" : "ea9ab830-4418-4dde-9738-ab84510687fc",
      "type" : "packetbeat",
      "version" : "6.5.4",
      "name" : "abc"
    },
    "state" : {
      "beat" : {
        "name" : "host1"
      },
      "host" : {
        "architecture" : "x86_64",
        "os" : {
          "platform" : "rhel",
          "version" : "7.4 (Maipo)",
          "family" : "",
          "codename" : "Maipo"
        },
        "id" : "dcc182a64f544eeebedf7d8df588452b",
        "containerized" : "containerized",
        "name" : "host1"
      },
      "management" : {
        "enabled" : false
      },
      "queue" : {
        "name" : "mem"
      },
      "output" : {
        "name" : "elasticsearch"
      },
      "service" : {
        "version" : "6.5.4",
        "name" : "packetbeat",
        "id" : "0d4e7da2-f933-4ae9-9b92-56a4c613abc3"
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![fkelbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fkelbert/32/35762_2.png) [@fkelbert](https://discuss.elastic.co/u/fkelbert)\
**Post date:** [February 12, 2019, 4:33pm UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/4 "2019-02-12T16:33:51Z")

</div>

You could, for example, run a [`terms` aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/search-aggregations-bucket-terms-aggregation.html) over the field `source_node.name` or `source_node.host` and then compare the returned list against the list of hosts that you are expecting, e.g., using a [Painless script](https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-scripting-painless.html) within the [Watcher condition](https://www.elastic.co/guide/en/elastic-stack-overview/current/condition.html).

All information about Watchers and their parts are detailed in the [Watcher API](https://www.elastic.co/guide/en/elasticsearch/reference/current/watcher-api.html). If you have an Elasticsearch subscription (which you seem to have), you might also want to consult [Elastic Support](https://www.elastic.co/support/welcome) with any concrete Watchers that you might have trouble with.

---

<div class="post-metadata">

**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Post date:** [February 13, 2019, 5:12am UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/5 "2019-02-13T05:12:53Z")

</div>

Ok if i write Aggregation query like bellow

> {  
> "query": {  
> "bool": {  
> "must": [  
> {  
> "match\_all": {}  
> }  
> ],  
> "filter": {  
> "range": {  
> "timestamp": {  
> "gte": "now-15m",  
> "lte": "now"  
> }  
> }  
> }  
> }  
> },  
> "aggs": {  
> "AggregatedData": {  
> "terms": {  
> "field": "beats\_stats.beat.name"  
> }  
> }  
> }  
> }

outcome is:

> {  
> "aggregations" : {  
> "AggregatedData" : {  
> "doc\_count\_error\_upper\_bound" : 0,  
> "sum\_other\_doc\_count" : 0,  
> "buckets" : [  
> {  
> "key" : "beat1",  
> "doc\_count" : 90  
> },  
> {  
> "key" : "beat2",  
> "doc\_count" : 6  
> }  
> ]  
> }  
> }  
> }

if i change my filter query to check for last 1 min data

> {  
> "query": {  
> "bool": {  
> "must": [  
> {  
> "match\_all": {}  
> }  
> ],  
> "filter": {  
> "range": {  
> "timestamp": {  
> "gte": "now-1m",  
> "lte": "now"  
> }  
> }  
> }  
> }  
> },  
> "aggs": {  
> "AggregatedData": {  
> "terms": {  
> "field": "beats\_stats.beat.name"  
> }  
> }  
> }  
> }

i am not gwtting host1 in result because beat1 is down from last few minutes:

> {  
> "aggregations" : {  
> "AggregatedData" : {  
> "doc\_count\_error\_upper\_bound" : 0,  
> "sum\_other\_doc\_count" : 0,  
> "buckets" : [  
> {  
> "key" : "beat2",  
> "doc\_count" : 6  
> }  
> ]  
> }  
> }  
> }

how do i compare this two queries result , and moreover how to configure it in watcher.  
Sorry i don't have much idea about creating watcher seeking for help.

Thanks  
Ramya

---

<div class="post-metadata">

**Author:** ![fkelbert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fkelbert/32/35762_2.png) [@fkelbert](https://discuss.elastic.co/u/fkelbert)\
**Post date:** [February 13, 2019, 12:19pm UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/6 "2019-02-13T12:19:24Z")

</div>

[Watcher input](https://www.elastic.co/guide/en/elastic-stack-overview/current/input.html): For the Watcher input, you would use a [`chain` input](https://www.elastic.co/guide/en/elastic-stack-overview/current/input-chain.html). A chain input allows you to execute multiple inputs of type [`search`](https://www.elastic.co/guide/en/elastic-stack-overview/current/input-search.html). These searches would be the two aggregations that you detailed above.

[Watcher condition](https://www.elastic.co/guide/en/elastic-stack-overview/current/condition.html): Within the condition, you would use a [`script` condition](https://www.elastic.co/guide/en/elastic-stack-overview/current/condition-script.html). Within a script, you can use the [Painless scripting language](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/modules-scripting-painless.html) to compare the two result sets from the above searches.

---

<div class="post-metadata">

**Author:** ![RamyaGowda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramyagowda/32/27440_2.png) [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\
**Post date:** [February 14, 2019, 5:59am UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/7 "2019-02-14T05:59:44Z")

</div>

Hi @fklbert,

Thank you for your help!

I have tried Configuring watcher ,able to use chain input properly.  
Not understanding how to compare two aggregations result using Painless scrpting lauguage.☹

Configured watcher like bellow:

> {  
> "trigger": {  
> "schedule": {  
> "interval": "1m"  
> }  
> },  
> "input": {  
> "chain": {  
> "inputs": [  
> {  
> "first": {  
> "search": {  
> "request": {  
> "search\_type": "query\_then\_fetch",  
> "indices": [  
> ".monitoring-beats-6-2019.02.14"  
> ],  
> "types": ,  
> "body": {  
> "query": {  
> "bool": {  
> "must": [  
> {  
> "match\_all": {}  
> }  
> ]  
> }  
> },  
> "aggs": {  
> "AggregatedData": {  
> "terms": {  
> "field": "beats\_stats.beat.name"  
> }  
> }  
> },  
> "\_source": [  
> "message"  
> ]  
> }  
> }  
> }  
> }  
> },  
> {  
> "second": {  
> "search": {  
> "request": {  
> "search\_type": "query\_then\_fetch",  
> "indices": [  
> ".monitoring-beats-6-2019.02.14"  
> ],  
> "types": ,  
> "body": {  
> "query": {  
> "bool": {  
> "must": [  
> {  
> "match\_all": {}  
> },  
> {  
> "filter": {  
> "range": {  
> "timestamp": {  
> "gte": "now-5m",  
> "lte": "now"  
> }  
> }  
> }  
> }  
> ]  
> }  
> },  
> "aggs": {  
> "AggregatedData": {  
> "terms": {  
> "field": "beats\_stats.beat.name"  
> }  
> }  
> },  
> "\_source": [  
> "message"  
> ]  
> }  
> }  
> }  
> }  
> }  
> ]  
> }  
> },  
> "condition": {  
> "script": {  
> "source": "return result",  
> "lang": "painless"  
> }  
> },  
> "actions": {  
> "email\_users": {  
> "email": {  
> "profile": "standard",  
> "priority": "high",  
> "to": [  
> "[ramya.cp@gmail.com](mailto:ramya.cp@gmail.com)"  
> ],  
> "subject": "PACKETBEAT ALERT: in this host xxxx packetbeat is not running since x minute/hour!",  
> "body": {  
> }  
> }  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2019, 5:59am UTC](https://discuss.elastic.co/t/create-alerts-in-packetbeat-monitoring/167970/8 "2019-03-14T05:59:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.