# ElasticSearch: Logic to alert based on dynamic threshold specified in a csv file

**URL:** <https://discuss.elastic.co/t/elasticsearch-logic-to-alert-based-on-dynamic-threshold-specified-in-a-csv-file/245449>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 18, 2020, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-logic-to-alert-based-on-dynamic-threshold-specified-in-a-csv-file/245449 "2020-08-18T14:44:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [August 18, 2020, 2:44pm UTC](https://discuss.elastic.co/t/elasticsearch-logic-to-alert-based-on-dynamic-threshold-specified-in-a-csv-file/245449/1 "2020-08-18T14:44:21Z")

</div>

folks,  
I've got a requirement,

- Get error codes from raw data within a particular time period
- if the count of error codes is greater than count specified in a lookup/csv list, then alert

I understand there is NO lookup functionality in Elasticsearch/Kibana , but hence planning to index the csv file daily (or regularly)

For example,  
RAW data for particular time period

```auto
2020-08-10 10:00:00 myapp1 some-payload1 error_code=501
2020-08-10 10:10:00 myapp2 some-payload2 error_code=502
2020-08-10 10:20:00 myapp3 some-payload3 error_code=501
2020-08-10 10:30:00 myapp4 some-payload4 error_code=501

```

CSV/lookup thresholds

```auto
error_code,threshold_count
500,10
501,2
502,5

```

So in the above case, my logic has to lookup the CSV and check if the `error_code` is greater than `threshold_count` and alert. In above example `501` should alert as there are 3 occurences in the raw log , but the `threshold_count` is only 2

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 18, 2020, 9:49pm UTC](https://discuss.elastic.co/t/elasticsearch-logic-to-alert-based-on-dynamic-threshold-specified-in-a-csv-file/245449/2 "2020-08-18T21:49:23Z")

</div>

Per your other thread, you should be able to do something with [https://www.elastic.co/guide/en/elasticsearch/reference/current/input-chain.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/input-chain.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2020, 9:49pm UTC](https://discuss.elastic.co/t/elasticsearch-logic-to-alert-based-on-dynamic-threshold-specified-in-a-csv-file/245449/3 "2020-09-15T21:49:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.