# Email ElastAlert Not triggering on Average Aggregation query
**URL:** https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948
**Category:** Elasticsearch
**Created:** [October 22, 2020, 7:15am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948 "2020-10-22T07:15:36Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Chennai\_Cheetah](https://discuss.elastic.co/u/Chennai_Cheetah)
#### Post date: [October 22, 2020, 7:15am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948/1 "2020-10-22T07:15:36Z")
Mail is not triggering for my elast alert aggregator rule.
I have a Elastic DSL Query which returns me an average Response time for the API for the last 15 mins.
My objective is to fire email if the API average response time \> 5sec.
In the below DSL Query response I am getting an average of 5.32. But In elastalert rules, no alerts are not generating for the same elastalert configuraiton
**Rules.yaml**
es\_host: 100.10.10.100
es\_port: 9200
es\_username: elastic
es\_password: elastic
name: Average ResponseTime
type: metric\_aggregation
index: logstashlogs-\*
bucket\_interval:
minutes: 15
metric\_agg\_key: elapsed\_time
metric\_agg\_type: avg
doc\_type: \_doc
max\_threshold: 5
filter:
- term:
doc.processName: CreateCustomer
- term:
doc.messageType: SourceResponse
alert:
- email
email:
- [Test1234@gmail.com](mailto:Test1234@gmail.com)
alert\_subject: Avg response lapsed
alert\_text: |
Testing for average response time.
alert\_text\_type: alert\_text\_only
smtp\_host: 100.100.10.10
smtp\_port: 25
smtp\_ssl: false
from\_addr: [test@gmail.com](mailto:test@gmail.com)
smtp\_auth\_file: smtp\_auth\_file.yaml
```auto
**Output from elastalert**
```
1 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are:
INFO:elastalert:Sleeping for 59.999888 seconds
INFO:elastalert:Ran Average ResponseTime from 2020-10-21 11:42 UTC to 2020-10-21 11:57 UTC: 0 query hits (0 already seen), 0 matches, 0 alerts sent
INFO:elastalert:Background configuration change check run at 2020-10-21 11:58 UTC
INFO:elastalert:Background alerts thread 0 pending alerts sent at 2020-10-21 11:58 UTC
```auto
But If I cross check in Curl I am getting average value
DSL Query
{
"aggs":{
"processFilter":{
"filter":{
"bool":{
"should":[
{
"bool":{
"must":[
{
"match":{
"doc.processName":"CreateCustomer"
}
},
{
"match":{
"doc.messageType":"SourceResponse"
}
},
{
"range":{
"@timestamp":{
"gte":"now-30m/m",
"lte":"now/m"
}
}
}
]
}
}
]
}
},
"aggs":{
"avg_et":{
"avg":{
"field":"elapsed_time"
}
}
}
}
}
}
**Response :**
"aggregations" : {
"processFilter" : {
"meta" : { },
"doc_count" : 5,
" **avg_et**" : {
"value" : 5.3289999008178714
}
}
}
}
```
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 22, 2020, 9:51am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948/2 "2020-10-22T09:51:28Z")
You might have more luck asking this in the elastalert forums/github repositories than over here, as most questions here revolve about [alerting](https://www.elastic.co/guide/en/kibana/7.9/kibana-alerts.html).
---
### Author:  [@Chennai\_Cheetah](https://discuss.elastic.co/u/Chennai_Cheetah)
#### Post date: [October 22, 2020, 10:20am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948/3 "2020-10-22T10:20:41Z")
Thanks Spinscale. Apologies over this post over here.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 19, 2020, 10:20am UTC](https://discuss.elastic.co/t/email-elastalert-not-triggering-on-average-aggregation-query/252948/4 "2020-11-19T10:20:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.