# Error managing RECOVERED alerts

**URL:** <https://discuss.elastic.co/t/error-managing-recovered-alerts/265957>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [March 2, 2021, 12:44pm UTC](https://discuss.elastic.co/t/error-managing-recovered-alerts/265957 "2021-03-02T12:44:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marti1](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@marti1](https://discuss.elastic.co/u/marti1)\
**Post date:** [March 2, 2021, 12:44pm UTC](https://discuss.elastic.co/t/error-managing-recovered-alerts/265957/1 "2021-03-02T12:44:49Z")

</div>

Hi,  
After configure some alerts for metrics using "Inventory" and "Metrics threshold" types and setting up one index connector, Kibana is constantly creating RECOVERED records into my index without fired cases.  
Actually, is running this RECOVERED connector each time that the alert is checked (Ex: for each check (1m) I've got a new record).

As far as I know, these RECOVERED records should be written into my index only after the alert is fired and resolved.

Also, I have one Stack Alert (Index threshold) configured with the same actions (fired and recovered) and I don't have that problem. Recovered record is written only after fired status.

Any idea why the behavior is different between METRIC ALERTS and STACK ALERTS? Is that an error?

Thanks in advance 🙂

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [March 5, 2021, 12:39pm UTC](https://discuss.elastic.co/t/error-managing-recovered-alerts/265957/2 "2021-03-05T12:39:55Z")

</div>

For metrics threshold it defaults to the recovered action. This is not a default on the other Alerts since you could add different actions and connectors there:

> <https://github.com/elastic/kibana/issues/64351>
>
> ⚠️ Depends on #49405
> As brought up in #64080
> Send an alert like
> My Alert - elasticsearch-master-0 is in a state of OK \[Recovered\]
> Because...

---

<div class="post-metadata">

**Author:** ![marti1](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@marti1](https://discuss.elastic.co/u/marti1)\
**Post date:** [March 8, 2021, 7:39am UTC](https://discuss.elastic.co/t/error-managing-recovered-alerts/265957/3 "2021-03-08T07:39:57Z")

</div>

Hi Marius,  
Thanks for your reply.

Then, how can I change that default recovered action?  
I would like to trigger recovered actions in metrics threshold only once (just after fired status).

Thanks in advance 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2021, 7:40am UTC](https://discuss.elastic.co/t/error-managing-recovered-alerts/265957/4 "2021-04-05T07:40:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.