Error managing RECOVERED alerts

Elastic Stack Kibana
1

Hi,
After configure some alerts for metrics using "Inventory" and "Metrics threshold" types and setting up one index connector, Kibana is constantly creating RECOVERED records into my index without fired cases.
Actually, is running this RECOVERED connector each time that the alert is checked (Ex: for each check (1m) I've got a new record).

As far as I know, these RECOVERED records should be written into my index only after the alert is fired and resolved.

Also, I have one Stack Alert (Index threshold) configured with the same actions (fired and recovered) and I don't have that problem. Recovered record is written only after fired status.

Any idea why the behavior is different between METRIC ALERTS and STACK ALERTS? Is that an error?

Thanks in advance :slight_smile:

2

For metrics threshold it defaults to the recovered action. This is not a default on the other Alerts since you could add different actions and connectors there:

1 Like
3

Hi Marius,
Thanks for your reply.

Then, how can I change that default recovered action?
I would like to trigger recovered actions in metrics threshold only once (just after fired status).

Thanks in advance :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.