# How to check if a keyword exists in elastalert

**URL:** <https://discuss.elastic.co/t/how-to-check-if-a-keyword-exists-in-elastalert/337581>\
**Category:** Elasticsearch\
**Created:** [July 4, 2023, 5:05pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-keyword-exists-in-elastalert/337581 "2023-07-04T17:05:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chel\_Db](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chel_db/32/121875_2.png) [@Chel\_Db](https://discuss.elastic.co/u/Chel_Db)\
**Post date:** [July 4, 2023, 5:05pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-keyword-exists-in-elastalert/337581/1 "2023-07-04T17:05:50Z")

</div>

I wanted to send out an alert to our slack channel if a there is an indexing error or the number of events \> 20 for last 10 minutes. Below is my elastalert yaml configuration.

```auto
influx_indexing_error_slack_message_rule: |-
    ---
    es_host: elk.org.my.com
    es_port: 9200 
    name: failure message
    index: logstash-influxdb*
    type: frequency
    num_events: 20
    timeframe:
      minutes: 10
    realert:
      minutes: 15
    filter:
    - exists:
        field: "error.keyword"
    alert:
    - "slack"
       slack related detail

```

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cdb430cbbb1963a1233549057c75ece377645bf7.png)

Will this work real time ? I don't see much of a documentation covering the exists conditions, hence reached out to you experts here.

I went thru - [Writing Filters For Rules — ElastAlert 0.0.1 documentation](https://elastalert.readthedocs.io/en/latest/recipes/writing_filters.html)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 4, 2023, 5:10pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-keyword-exists-in-elastalert/337581/2 "2023-07-04T17:10:47Z")

</div>

Hi @Chel_Db

Elastalert is not part of the Elastic Stack so you really need to go to their forums to ask questions... We are not experts on that.

If you have questions on the built in Alerting framework we are happy to help with that! 🙂

---

<div class="post-metadata">

**Author:** ![Chel\_Db](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chel_db/32/121875_2.png) [@Chel\_Db](https://discuss.elastic.co/u/Chel_Db)\
**Post date:** [July 4, 2023, 5:14pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-keyword-exists-in-elastalert/337581/3 "2023-07-04T17:14:33Z")

</div>

My bad, thanks @stephenb . I will reach out to them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2023, 5:15pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-keyword-exists-in-elastalert/337581/4 "2023-08-01T17:15:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.