How to configure alert hierarchy/levels in kibana

Elastic Stack Elasticsearch
1

Hi,

How to configure alert hierarchy/levels in Kibana?
I need to:

  1. visualization of the overiding/primary alarm –> if I look at the list of alerts, I will see all of them marked red, but I want the system to notifiy me with the contents of the overiding/primary alarm. Meaning: trigger an alarm when an event occurs and thera are no N-overriding/primary events.

  2. delay configruration -> secondary alarms may appear before primary alarms, hence the need for delay

  3. If alarm will be transfered, The system will have to handle it - different systems on different levels - the simplest
    will set possibility to turn off the alarm through setting status for such alert as "during operation" or "fixed",
    such alarm will blink with colour but it won't make any sound. In such case, when our sub alerts will trigger before
    overriding alerts - those will have to be supported. How it is in the kibana? Can I get a sound signal?

Regards,
Magda

2

Hi @magda,

Watcher does not have a built-in way of expressing dependencies between watches. As such the Watcher UI in Kibana x-pack cannot understand and visualize dependencies between watches.

Currently the closest way to model a dependency like "watch A depends on watch B" would be for watch A to use the search input to retrieve watch B's latest execution result from the .watcher-history-* indices, and lookup its status (or some other field, depending on the nature of the dependency). Then watch A could respond appropriately in its next execution. However, in this model, the UI cannot know for sure that watch A is attempting to express a dependency on watch B, and hence cannot visualize it either.

Hope that makes sense.

Shaunak

3

Ok,
thank you for the reply!

Magda