# Creating advanced alerts

**URL:** https://discuss.elastic.co/t/creating-advanced-alerts/138989
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 6, 2018, 10:56pm UTC](https://discuss.elastic.co/t/creating-advanced-alerts/138989 "2018-07-06T22:56:41Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Rohit\_Jawle](https://avatars.discourse-cdn.com/v4/letter/r/ecb155/32.png) [@Rohit\_Jawle](https://discuss.elastic.co/u/Rohit_Jawle)
#### Post date: [July 6, 2018, 10:56pm UTC](https://discuss.elastic.co/t/creating-advanced-alerts/138989/1 "2018-07-06T22:56:41Z")

</div>

I need to create an alert that triggers when an approval rate is less than 85% over the last 10 minutes. The logs i get tell me if an event has been approved or declined. How do i add all the approved and declines over the last 10 minutes then create a proportion out of it in an alert?

---

<div class="post-metadata">

### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [July 8, 2018, 10:17am UTC](https://discuss.elastic.co/t/creating-advanced-alerts/138989/2 "2018-07-08T10:17:30Z")

</div>

You first need to construct an ES query that will give you the ratio you desire, then use that ES query as the basis for your Watch for alerting.

The ES query to calculate the ratio will use a [bucket script aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-script-aggregation.html)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 5, 2018, 10:22am UTC](https://discuss.elastic.co/t/creating-advanced-alerts/138989/3 "2018-08-05T10:22:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
