# Create and alert based on a GROUP BY **URL:** \ **Category:** Logs\ **Tags:** elastic-stack-alerting\ **Created:** [June 3, 2024, 10:39am UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706 "2024-06-03T10:39:22Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Matteo\_Mariotti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matteo_mariotti/32/134993_2.png) [@Matteo\_Mariotti](https://discuss.elastic.co/u/Matteo_Mariotti)\ **Post date:** [June 3, 2024, 10:39am UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/1 "2024-06-03T10:39:23Z")
Hi Community, I have a system that logs a JSON object containing a user\_id field into a document, and I need to create an alert that notifies me if a user makes more than a certain number of accesses within a certain time frame. I tried creating a log threshold alert, but I don't have access to the fields of the message. Alternatively, if I try to create an alert with KQL query, I don't have access to the group by function. Any advice on how to solve this? ---
**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\ **Post date:** [June 3, 2024, 10:54am UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/2 "2024-06-03T10:54:18Z")
Hi Matteo, Welcome to the Elastic communtiy. 1. May I know what kind of access you have currently ? 2. You can refer [log threshold alert](https://www.elastic.co/guide/en/observability/current/logs-threshold-alert.html) to set the same but it required count and group by command. ---
**Author:** ![Matteo\_Mariotti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matteo_mariotti/32/134993_2.png) [@Matteo\_Mariotti](https://discuss.elastic.co/u/Matteo_Mariotti)\ **Post date:** [June 3, 2024, 12:13pm UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/3 "2024-06-03T12:13:38Z")
Hi, thanks for your quick response. I am currently an "organization owner" on the ELK deployment. I red those docs this morning, still, I didn't understand how to access the fields of the json object (e.g. how to do message.used\_id IS sth) ---
**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\ **Post date:** [June 3, 2024, 3:04pm UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/4 "2024-06-03T15:04:23Z")
You can access nested field using dot(.) only. Could you please share your sample json document? and on which field you want to perform count ? ---
**Author:** ![Matteo\_Mariotti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matteo_mariotti/32/134993_2.png) [@Matteo\_Mariotti](https://discuss.elastic.co/u/Matteo_Mariotti)\ **Post date:** [June 3, 2024, 3:24pm UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/5 "2024-06-03T15:24:56Z")
Sure, The structure of the "message" is: { "AuthenticationSuccess": { "status": 200, "user\_id": "test\_user", "message": "OK", "source": "portal" } } What I need to do is acces the user\_id field from the following alert section ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d9de3fab02aa9379c88460389f108a3ffb87e57a.png) but even using dot(.) I cannot access it. What I am trying to achieve is raise an alert if a user tries to login too many times in a certain time frame (so I am trying to group by user and then count and raise the alert) ---
**Author:** ![Matteo\_Mariotti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matteo_mariotti/32/134993_2.png) [@Matteo\_Mariotti](https://discuss.elastic.co/u/Matteo_Mariotti)\ **Post date:** [June 3, 2024, 3:25pm UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/6 "2024-06-03T15:25:28Z")
This is an example of the log in the "Discovery" section ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9aff74adfcf7eb4f1f3d9259d118e721b8e7bda3.png) ---
**Author:** ![ashishtiwari1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashishtiwari1993/32/135241_2.png) [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\ **Post date:** [June 3, 2024, 3:31pm UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/7 "2024-06-03T15:31:38Z")
> [@Matteo\_Mariotti](#): > > AuthenticationSuccess As far I understand, You should access like this `AuthenticationSuccess.user_id`. Why you trying to access from `message` field? I am assuming you have shared json doc structure. ---
**Author:** ![Matteo\_Mariotti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matteo_mariotti/32/134993_2.png) [@Matteo\_Mariotti](https://discuss.elastic.co/u/Matteo_Mariotti)\ **Post date:** [June 3, 2024, 3:42pm UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/8 "2024-06-03T15:42:39Z")
Yes, my bad. Still, it doesn't find the field ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/c/2cfb6724c86a1b799d04971d8f49533b94f18d1f.png) I tried with "message.AuthenticationSuccess.user\_id" as well ---
**Author:** ![Matteo\_Mariotti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matteo_mariotti/32/134993_2.png) [@Matteo\_Mariotti](https://discuss.elastic.co/u/Matteo_Mariotti)\ **Post date:** [June 5, 2024, 8:53am UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/9 "2024-06-05T08:53:11Z")
Quick update: I did manage to solve my issue by using the "Alerts" section under "Security" instead of using the one in "Stack management" ---
**Author:** ![AnthonyKeydel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anthonykeydel/32/135387_2.png) [@AnthonyKeydel](https://discuss.elastic.co/u/AnthonyKeydel)\ **Post date:** [September 11, 2024, 8:39pm UTC](https://discuss.elastic.co/t/create-and-alert-based-on-a-group-by/360706/10 "2024-09-11T20:39:51Z")
I'm running into the same issue - many fields are missing from the **Grouped Over** menu options in Alerts. The one in particular that I would like to use is cluster\_name. It is not nested, and is mapped statically in the index template. Every event has this field in it, and yet ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/0258be9db56b3280c8eac3428e79871a37cdd36b.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/3/0350eddb8463055a5d7855f49e405b999a95282a.png) As I do not have [the appropriate license](https://www.elastic.co/guide/en/security/8.13/detections-permissions-section.html) to use the Security alert feature, I can't use that solution. Any idea why are some fields not available to group by...? > **Full JSON** > > { > "\_index": "vcmts-beats-nocontainer-2024.09.11", > "\_id": "tiLD4pEBhUFuJomPPsZu", > "\_version": 1, > "\_score": 0, > "\_source": { > "tags": [ > "beats\_input\_codec\_plain\_applied" > ], > "@timestamp": "2024-09-11T20:25:31.610Z", > "message": "Trace[1770768237]: ---"Listing from storage done" 805ms (20:25:30.825)", > "cluster\_name": "ClusterName", > "type": "vcmts", > "node\_name": "", > "event": { > "original": "Trace[1770768237]: ---"Listing from storage done" 805ms (20:25:30.825)" > }, > "@version": "1", > "app": "platform.kube\_apiserver", > "site\_name": "" > }, > "fields": { > "app": [ > "platform.kube\_apiserver" > ], > "cluster\_name": [ > "ClusterName" > ], > "event.original": [ > "Trace[1770768237]: ---"Listing from storage done" 805ms (20:25:30.825)" > ], > "node\_name": [ > "" > ], > "tags.keyword": [ > "beats\_input\_codec\_plain\_applied" > ], > "@version.keyword": [ > "1" > ], > "message": [ > "Trace[1770768237]: ---"Listing from storage done" 805ms (20:25:30.825)" > ], > "type": [ > "vcmts" > ], > "tags": [ > "beats\_input\_codec\_plain\_applied" > ], > "site\_name": [ > "" > ], > "@timestamp": [ > "2024-09-11T20:25:31.610Z" > ], > "@version": [ > "1" > ], > "app.keyword": [ > "platform.kube\_apiserver" > ] > } > }