# How can alerts be set up on a series of values?

**URL:** <https://discuss.elastic.co/t/how-can-alerts-be-set-up-on-a-series-of-values/255177>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [November 12, 2020, 9:22am UTC](https://discuss.elastic.co/t/how-can-alerts-be-set-up-on-a-series-of-values/255177 "2020-11-12T09:22:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![taabishm2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taabishm2/32/78886_2.png) [@taabishm2](https://discuss.elastic.co/u/taabishm2)\
**Post date:** [November 12, 2020, 9:22am UTC](https://discuss.elastic.co/t/how-can-alerts-be-set-up-on-a-series-of-values/255177/1 "2020-11-12T09:22:57Z")

</div>

I am generating a series of numerical values representing failed calls, grouped by their source application. Here is a basic tabular representation of this data:

 ![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa46b9193732df0a75d350af69c8dee982fb5ed2.png)  
 ![Untitled.pngq](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc1be5539a741747a9a00cedb76f64e2cac5478c.png)

I am trying to create threshold-based alerts that should be executed for each application that satisfies the condition. Presently, I can fetch the maximum across applications and execute the alert, however, my goal is to be able to check the application group data and execute an alert for that application if required. Then, the next application group should be checked and alerted if necessary. This should happen across all the applications that are present.

Although I could manually create a separate watch for each application, however, that would be tedious and difficult to maintain. Is there an alternate approach to creating such alerts?

Note: The json aggregations for the above data are as follows:

```auto
"aggregations": {
    "2": {
      "buckets": [
        {
          "3": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "4": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 244,
                  "buckets": [
                    {
                      "key": "channelB",
                      "doc_count": 1746
                    },
                    {
                      "key": "channelD",
                      "doc_count": 598
                    },
                    {
                      "key": "channelC",
                      "doc_count": 354
                    }
                  ]
                },
                "key": "FAILURE",
                "doc_count": 2942
              }
            ]
          },
          "key_as_string": "2020-11-06T17:00:00.000+05:30",
          "key": 1604662200000,
          "doc_count": 2942
        },
        {
          "3": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "4": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 226,
                  "buckets": [
                    {
                      "key": "channelB",
                      "doc_count": 1714
                    },
                    {
                      "key": "channelD",
                      "doc_count": 577
                    },
                    {
                      "key": "channelC",
                      "doc_count": 316
                    }
                  ]
                },
                "key": "FAILURE",
                "doc_count": 2833
              }
            ]
          },
          "key_as_string": "2020-11-06T18:00:00.000+05:30",
          "key": 1604665800000,
          "doc_count": 2833
        },
        {
          "3": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "4": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 112,
                  "buckets": [
                    {
                      "key": "channelB",
                      "doc_count": 856
                    },
                    {
                      "key": "channelD",
                      "doc_count": 278
                    },
                    {
                      "key": "channelC",
                      "doc_count": 162
                    }
                  ]
                },
                "key": "FAILURE",
                "doc_count": 1408
              }
            ]
          },
          "key_as_string": "2020-11-06T19:00:00.000+05:30",
          "key": 1604669400000,
          "doc_count": 1408
        }
      ]
    }
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 10, 2020, 9:23am UTC](https://discuss.elastic.co/t/how-can-alerts-be-set-up-on-a-series-of-values/255177/2 "2020-12-10T09:23:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.