# Doubts about Kibana Rules and conections alerts **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [May 26, 2023, 3:37pm UTC](https://discuss.elastic.co/t/doubts-about-kibana-rules-and-conections-alerts/334450 "2023-05-26T15:37:21Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Post date:** [May 26, 2023, 3:37pm UTC](https://discuss.elastic.co/t/doubts-about-kibana-rules-and-conections-alerts/334450/1 "2023-05-26T15:37:21Z")
Hi, I got a couple of doubts: - In a Metric threshold rule, the condition "For the last 5 minutes" will trigger an alert if any document in that time range surpass the threshold specified? or is it like a bucket? if the average of many documents on those 5 minutes surpass the threshold? - if an alert has been triggered because the data surpass a threshold, it will remain in active status while the data doesnt go below the threshold? meaning that no new alert will be sent because its already alerted? Thanks. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 26, 2023, 7:54pm UTC](https://discuss.elastic.co/t/doubts-about-kibana-rules-and-conections-alerts/334450/2 "2023-05-26T19:54:14Z")
Hi @ElasticLiver > [@ElasticLiver](#): > > In a Metric threshold rule, the condition "For the last 5 minutes" will trigger an alert if any document in that time range surpass the threshold specified? or is it like a bucket? if the average of many documents on those 5 minutes surpass the threshold? It is an aggregation over that bucket but you pick the aggregation Average (which the average would have to be over for 5 mins) of Max (a max within the 5 Minutes) etc ![Screenshot 2023-05-26 at 12.48.31 PM](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30fb4c959126da713bba5f013d36fb5045505ddd.jpeg) > [@ElasticLiver](#): > > if an alert has been triggered because the data surpass a threshold, it will remain in active status while the data doesnt go below the threshold? meaning that no new alert will be sent because its already alerted? You chose again... If you select Only On Status change you will only get the alert action Once when The alert is Triggered Or you can send repeated alerts each time the rule is Fired Or you can pick some other interval like every 30 mins... ![Screenshot 2023-05-26 at 12.50.42 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc8faae522b8fc23a75ea6b51490b248a7662c05.png) You can also define to send a Recovered Action ![Screenshot 2023-05-26 at 12.53.03 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/e/ae2c1cc2fa246eb66b5b779458c98ed0d524c940.png) BTW You can add a Warning Threshold ![Screenshot 2023-05-26 at 12.55.35 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d7a21b7dfaadc5333f035f091b26a545ee85040e.png) as well A pretty easy to test all this is to run metricbeat on your laptop and then rsetup an alert then run some heavy process to trigger the alert ... then stop it etc... you should be able to see the behavior ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 23, 2023, 7:55pm UTC](https://discuss.elastic.co/t/doubts-about-kibana-rules-and-conections-alerts/334450/3 "2023-06-23T19:55:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.