# How can I create an alert for one-time events?

**URL:** <https://discuss.elastic.co/t/how-can-i-create-an-alert-for-one-time-events/383781>\
**Category:** Elastic Observability\
**Created:** [December 1, 2025, 12:51pm UTC](https://discuss.elastic.co/t/how-can-i-create-an-alert-for-one-time-events/383781 "2025-12-01T12:51:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nilsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nilsen/32/146631_2.png) [@nilsen](https://discuss.elastic.co/u/nilsen)\
**Post date:** [December 1, 2025, 12:51pm UTC](https://discuss.elastic.co/t/how-can-i-create-an-alert-for-one-time-events/383781/1 "2025-12-01T12:51:58Z")

</div>

I want to set up an alert that triggers whenever one of my APIs returns a 500 error. This doesn’t really fit into the usual _active/recovered/flapping_ model since it’s more of a single event rather than something that stays active or recovers.

One idea could be to have the alert automatically create a case for each occurrence—but I’m not sure if that’s a good approach.

How do others typically handle alerts for events where you don’t want them to disappear as “recovered”? Any suggestions?

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [December 12, 2025, 1:09pm UTC](https://discuss.elastic.co/t/how-can-i-create-an-alert-for-one-time-events/383781/2 "2025-12-12T13:09:40Z")

</div>

Hello @nilsen

I understand your scenario about checking an API =\> 500 , means an alert will be created. In next execution if it does not match the criteria the alert will be recovered but you want this to stay as Active, right? I do not think this is possible at rule level in kibana.

Generally the Action part is integrated to Ticketing Tool in your org by which when the alert triggers a ticket will be created in your ticketing tool & even if the alert is recovered you still have a ticket with you in your ticketing system.

Thanks!!

---

<div class="post-metadata">

**Author:** ![nilsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nilsen/32/146631_2.png) [@nilsen](https://discuss.elastic.co/u/nilsen)\
**Post date:** [January 9, 2026, 8:48am UTC](https://discuss.elastic.co/t/how-can-i-create-an-alert-for-one-time-events/383781/3 "2026-01-09T08:48:41Z")

</div>

Sorry for a very late reply.

Yes, I think you understand it correctly. Adding an action that reports to our Jira might be the solution here.