Exclude monitors that have a specific tag, but Alert still counts these monitors

[Mark_Veenstra]

I am trying to alert on monitors excluding monitors that have the tag no-alert. See the next configuration:

Which shows it will be applied to 32 monitors. Which is correct there are 2 monitors that have that tag. So all seems well. But once I save this monitor. It will send an alert (webhook). Because of these 2 monitors that should get excluded!

We are running on version 7.8.0. I also tried several ways of querying but all do not work correctly. Is this a known bug or am I doing something completely wrong here?

For example the next query does not work either:

• NOT tags : "no-alert"

[jkambic (Justin Kambic)]

Hi @Mark_Veenstra, thanks for taking the time to post in our forum.

Is this a known bug or am I doing something completely wrong here?

It looks to me that, yes, you are encountering a known bug. We recently resolved the issue tracking it.

The fix is present in upcoming releases 7.9.2 and 7.10.0 of the stack. At the moment there aren't any further scheduled patch releases for 7.8.x, so my recommendation would be upgrading when 7.9.2 is released.

[Mark_Veenstra]

@jkambic Thanks for pointing this out. But it seems the solution has been backported to 7.9.1: https://github.com/elastic/kibana/pull/75577#issuecomment-685792488

Would upgrading to 7.9.1 already solve it? Also the release notes of 7.9.1 mentions the same solution: https://www.elastic.co/guide/en/kibana/7.9/release-notes-7.9.1.html

[jkambic (Justin Kambic)]

@Mark_Veenstra

it seems the solution has been backported to 7.9.1

Right you are, I have updated the labels on the original PR to reflect this. Thank you for pointing that out.

In this case, yes I would try upgrading to 7.9.1 and see if it can resolve the problem you are experiencing!

[jkambic (Justin Kambic)]

Hi - I wanted to give you an update, that fix is labeled as 7.9.1 and was included in the release notes, but was included mistakenly. It was merged a few days after the release was cut from the 7.9 branch, so the fix will only be present in 7.9.2, I'm sorry for the confusion.