How can I get Automatic Acknowledgement-based Throttling?

alerting

(Alex) #1

This page: https://www.elastic.co/guide/en/watcher/current/watch-acknowledgment-throttling.html suggests that an action will only be executed once (until the condition becomes false and then true again). I would like to get that behavior.

However, I'm not clear on how I would achieve this "one alert per condition". I viewed this page: https://www.elastic.co/guide/en/watcher/current/actions.html. When I read that page, I see that can manually "ack" an alert, but I want the alert to work automatically as outlined in the previous paragraph -- i.e.

  • alert once
  • mark the alert as already triggered
  • clear the "already triggered" bit when the condition becomes false
  • alert again if the condition ever becomes true.

+1 for automatic acknowledgement in watcher
(Alexander Reelsen) #2

Hey,

couldnt you achieve the same with time based throttling and a very high throttle period?

--Alex


(Alex) #3

Hey, Alex.
I suspect you are correct, but I'm disappointed that the promise in the early part of the documentation is not fulfilled.

thanks,
-Alex


(Alex) #4

Alex,

So, I want to re-phrase the question from a different perspective.
I want to understand how to solve the problem outlined in Generic watch, specific alerts, duplicate alerting? before I even think about attempting your suggestion.


(system) #5