# ElastAlert triggering in 5 minutes instead of waiting for 60 minutes

**URL:** <https://discuss.elastic.co/t/elastalert-triggering-in-5-minutes-instead-of-waiting-for-60-minutes/207935>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 14, 2019, 4:35pm UTC](https://discuss.elastic.co/t/elastalert-triggering-in-5-minutes-instead-of-waiting-for-60-minutes/207935 "2019-11-14T16:35:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arnav\_Bose](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@Arnav\_Bose](https://discuss.elastic.co/u/Arnav_Bose)\
**Post date:** [November 14, 2019, 4:35pm UTC](https://discuss.elastic.co/t/elastalert-triggering-in-5-minutes-instead-of-waiting-for-60-minutes/207935/1 "2019-11-14T16:35:07Z")

</div>

I have an elastalert with type as frequency. If the number of hits is 1000 or more in 60 minutes, it should trigger the alert. The issue is, the moment it reaches 1000 hits within 5-6 minutes, it's triggering the alert instead of waiting for the entire 60 minutes' period. I want it to alert after the 60 minute period is over. I tried adding a realert for 60 minutes but it still did not work. What needs to be done to trigger an alert only when the 60 minutes period is over?

```auto
type: frequency
index: logstash-*
num_events: 1000
timeframe:
  minutes: 60
realert:
  minutes: 60
query_key: site_name
filter:
- query:
    query_string:
       query: 'NOT site_name: "CCBDN" AND NOT namespace: master'
alert: my_alerts.AlertManager
labels:
  severity: major  
  slack: 'true'
  auto_resolve: 'false'
annotations:
  summary: Kibana is getting logs from sites other than CCBDN.
```

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [November 14, 2019, 5:48pm UTC](https://discuss.elastic.co/t/elastalert-triggering-in-5-minutes-instead-of-waiting-for-60-minutes/207935/2 "2019-11-14T17:48:15Z")

</div>

Please reach out to the ElastAlert project for help on your issue. We have a watcher product of our own - please check that out as well - here is a quick start guide of that .Please reach out if you have any questions on this.

[https://www.elastic.co/guide/en/kibana/current/watcher-ui.html](https://www.elastic.co/guide/en/kibana/current/watcher-ui.html)

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2019, 5:48pm UTC](https://discuss.elastic.co/t/elastalert-triggering-in-5-minutes-instead-of-waiting-for-60-minutes/207935/3 "2019-12-12T17:48:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.