How to disable alerts on no data in Metric Threshold rule


I've set up a Metric Threshold alert on some fairly infrequent metric data (which actually comes from the Kubernetes Elastic Agent integration). The filter on the metric data is:* AND event.dataset: kubernetes.event AND kubernetes.event.type: Warning

The condition is:

and the grouping is:

However, I'm getting alerts for no data even though this makes no sense given I'm only interested in a document count >= 1. I also see that the checkboxes for enabling alerts on no data are greyed out, but checked. Why can these not be disabled?

Otherwise, this kind of alert is useless.

The natural language use case statement is: I want to be alerted if there is 1 or more Kubernetes warnings within the period of 10 min.

Hi @woodywoodsta,

the change that conditionally disables the checkbox was added in [Metrics UI] DIsable No Data checkboxes for doc count alerts by Zacqary · Pull Request #117194 · elastic/kibana · GitHub. Is it possible that you created the alert on an older version of Kibana and upgraded to a newer one since?

If so, I see two way that you could get rid of that enabled checkbox:

  1. Temporarily add a condition that is not based on a "document count" metric. This should re-enable the checkbox so you can uncheck it. Afterwards you can remove the temporary condition again.
  2. Re-create a new identical alert but without the box checked from the beginning.

Let us know if that works for you.

Hey @weltenwort. It's very possible that I was experimenting with other types of conditions in the same rule. I'll try what you have suggested and report back, thank you!

@weltenwort Temporarily changing the condition to enable the checkbox, uncheck and change the condition back to doc count worked correctly, thank you.

This seems like a bug to me, and I've actually already made a comment on that old PR asking about why this checkbox was disabled, since clearly it still "works" and is relevant in some use cases (albeit redundant). If we think it's a bug, I can open a new issue on the repo if needed.

Glad to hear it worked. I'm personally not sure why it was disabled for "document count" conditions, but I think it should at least be possible to toggle it off regardless. That part definitely feels like a UX bug.