How to create a watcher alert if a specific service goes down on a system which is monitored using metricbeat agent?

[Patr123]

I have few systems on which I have metricbeat v7.12.1 installed. How can I configure the watcher alert to send me an email if the service called testservice.exe goes down on server A?

[stephenb (Stephen Brown)]

Assuming you mean the new Kibana Alerting Framework.

You can test to see if there are no metrics reported with that process.name

You could also check the process state if you wanted.

Alert Type : Metric Threshold

[Patr123]

Thank you but this filter is for processes and not for services. Can I add a filter for services like this?

[stephenb (Stephen Brown)]

You can filter on any term in metricbeat ... services are processes are they not?

Can you give an example?

Can you see the testservice.exe reported in metricbeat data?

Take a look at the exported fields

System process metricset | Metricbeat Reference [7.12] | Elastic

[Patr123]

Yes that is correct. I was not monitoring the testservice.exe in my system.yml file. Once I did that change I was able to see it in the metrics.
Thank you so much Stephen.