# Difference between (on status changes, recovered) and (on check interval, recovered) when defining alert

**URL:** <https://discuss.elastic.co/t/difference-between-on-status-changes-recovered-and-on-check-interval-recovered-when-defining-alert/375631>\
**Category:** Elasticsearch\
**Created:** [March 10, 2025, 8:37am UTC](https://discuss.elastic.co/t/difference-between-on-status-changes-recovered-and-on-check-interval-recovered-when-defining-alert/375631 "2025-03-10T08:37:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\
**Post date:** [March 10, 2025, 8:37am UTC](https://discuss.elastic.co/t/difference-between-on-status-changes-recovered-and-on-check-interval-recovered-when-defining-alert/375631/1 "2025-03-10T08:37:47Z")

</div>

I was trying to define a rule of type `Elasticsearch query` in observability, in `action query` section i can not understand the difference between these two.

- option 1
  - for each alert: on status changes
  - run when: reovered

- option 2
  - for each alert: on check interval
  - run when: recovered

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a4074e86257df929c5cc2d864d2e7b7d63756b7.png)

It seems both actions only takes effect when alarm status changes form `active` to `recoverd`. So my question is what is there any difference between two options?