# Elastic Alert **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [October 18, 2022, 3:42am UTC](https://discuss.elastic.co/t/elastic-alert/316836 "2022-10-18T03:42:28Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![wijamw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wijamw/32/111240_2.png) [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Post date:** [October 18, 2022, 3:42am UTC](https://discuss.elastic.co/t/elastic-alert/316836/1 "2022-10-18T03:42:28Z")
Hello everyone, I am trying to set up an alert when the CPU is 100% for =\> 20 minutes. Here is my setup ![Rules-Elastic](https://us1.discourse-cdn.com/elastic/original/3X/5/3/535e2dcfc03de9058c5090d7a14988f24d0a36b4.png) But the alert comes even if it is only 100% for a few minutes. Is there something wrong with the configuration? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 24, 2022, 2:55pm UTC](https://discuss.elastic.co/t/elastic-alert/316836/2 "2022-10-24T14:55:04Z")
Hi @wijamw What version of the stack? Do you have multiple hosts? I think that graph sometimes is a bit misleading as I think it is an average of all the hosts. When you get the alert did you look at the individual host and see is CPU is above for 20 mins? ---
**Author:** ![wijamw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wijamw/32/111240_2.png) [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Post date:** [October 31, 2022, 1:55am UTC](https://discuss.elastic.co/t/elastic-alert/316836/3 "2022-10-31T01:55:12Z")
It was version 7.17 Elastic Cloud Stack Yes, I have multiple hosts and I have set up a filter on the alert condition. The filter looks like this: ```auto data_stream.dataset : "system.cpu" AND agent.hostname: ("hostname1" OR "hostname2" OR "hostname3") ``` ---
**Author:** ![wijamw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wijamw/32/111240_2.png) [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Post date:** [October 31, 2022, 1:56am UTC](https://discuss.elastic.co/t/elastic-alert/316836/4 "2022-10-31T01:56:42Z")
> [@stephenb](#): > > When you get the alert did you look at the individual host and see is CPU is above for 20 mins? Yes, I did, the CPU was 100% for one of the hosts for a minute or two. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [October 31, 2022, 2:42am UTC](https://discuss.elastic.co/t/elastic-alert/316836/5 "2022-10-31T02:42:08Z")
I looked at Metric Threshold So on my 7.17.6 I need to put in 100 to be 100% it looks like you put in 1 and it is 100% Metric Threshold ![Screen Shot 2022-10-30 at 7.48.13 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f2d4227f2b6ccf96ea9cc227fb12190333f3f4d1.png) Perhaps you should try that... You did not tell me the exact version perhaps upgrade to 7.17.6 Look like you are using an Inventory Rule looks like that take a 1... perhaps a bug with custom % metric ... Perhaps try Metric Threshold. ---
**Author:** ![wijamw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wijamw/32/111240_2.png) [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Post date:** [October 31, 2022, 4:48am UTC](https://discuss.elastic.co/t/elastic-alert/316836/6 "2022-10-31T04:48:55Z")
> [@stephenb](#): > > You did not tell me the exact version perhaps upgrade to 7.17.6 My bad, it is 7.17.0 Do the deployment need to be restarted if I want to upgrade it? > [@stephenb](#): > > Look like you are using an Inventory Rule looks like that take a 1... perhaps a bug with custom % metric ... > > Perhaps try Metric Threshold. Yes, I am using inventory rule. Thanks, I will try the metric threshold. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 26, 2022, 6:37am UTC](https://discuss.elastic.co/t/elastic-alert/316836/7 "2022-11-26T06:37:09Z")
---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 24, 2022, 3:34am UTC](https://discuss.elastic.co/t/elastic-alert/316836/8 "2022-12-24T03:34:51Z")
---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 21, 2023, 3:35am UTC](https://discuss.elastic.co/t/elastic-alert/316836/9 "2023-01-21T03:35:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.