# Creating alerts with aggregation and query filter

**URL:** <https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 25, 2022, 5:34pm UTC](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842 "2022-11-25T17:34:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![solange.sonaglio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solange.sonaglio/32/113799_2.png) [@solange.sonaglio](https://discuss.elastic.co/u/solange.sonaglio)\
**Post date:** [November 25, 2022, 5:34pm UTC](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842/1 "2022-11-25T17:34:24Z")

</div>

With the current data that we have in APM, we felt the need to create an alert based on an aggregated value, as the "Index threshold" type allows, however, we needed to include some filters in the data, as the "Elasticsearch query" type allows to do.

We haven't found a way to create an alert by combining the two options. Is there a way to do an aggregation based alert with query filter?

---

<div class="post-metadata">

**Author:** ![jughosta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jughosta/32/107160_2.png) [@jughosta](https://discuss.elastic.co/u/jughosta)\
**Post date:** [December 5, 2022, 12:21pm UTC](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842/2 "2022-12-05T12:21:27Z")

</div>

Hi @solange.sonaglio!  
Welcome to the community!

We are adding filters to "Index threshold" type in v8.6

> <https://github.com/elastic/kibana/pull/142255>
>
> Resolves: #66046
> 
> Adds a new filter field to index-threshold rule type.
> 
> To …validate:
> Create an index-threshold rule with and without filter and observe the number of documents in the visualisation.
> 
> \<img width="603" alt="index-th" src="https://user-images.githubusercontent.com/92688503/194085089-ee924265-1b28-4c0e-9ee6-820b58cb6e09.png"\>

---

<div class="post-metadata">

**Author:** ![solange.sonaglio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solange.sonaglio/32/113799_2.png) [@solange.sonaglio](https://discuss.elastic.co/u/solange.sonaglio)\
**Post date:** [December 7, 2022, 8:03pm UTC](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842/3 "2022-12-07T20:03:13Z")

</div>

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2023, 8:04pm UTC](https://discuss.elastic.co/t/creating-alerts-with-aggregation-and-query-filter/319842/4 "2023-01-04T20:04:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.