# How to not show closed alerts in the "Alerts"-Overview?

**URL:** <https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909>\
**Category:** Elastic Security\
**Created:** [June 26, 2023, 1:36pm UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909 "2023-06-26T13:36:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![m-flow](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@m-flow](https://discuss.elastic.co/u/m-flow)\
**Post date:** [June 26, 2023, 1:36pm UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909/1 "2023-06-26T13:36:59Z")

</div>

Hello everyone,

is there a way to suppress "closed" alerts in Kibana's "Alerts" view, when the status of all alerts changed from open to closed?

The general filter exists, but is ineffective when no alerts with the status "open" exist:

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a128635f827c3e516eda804350d80f07f4a8aa62.png)

It is possible to set a filter like this:

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32f4478db939ebbcc20155954373bde637c03bd9.png)

But this filter is not persistent. Does anyone know a way to filter the closed alerts in a persistent way? Otherwise it is confusing if Kibana shows currently **new** open alerts or closed ones...

Best Regards

---

<div class="post-metadata">

**Author:** ![m-flow](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@m-flow](https://discuss.elastic.co/u/m-flow)\
**Post date:** [June 26, 2023, 4:25pm UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909/2 "2023-06-26T16:25:48Z")

</div>

Further note: I use version 8.8.1

---

<div class="post-metadata">

**Author:** ![joean407](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@joean407](https://discuss.elastic.co/u/joean407)\
**Post date:** [June 28, 2023, 9:35am UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909/3 "2023-06-28T09:35:58Z")

</div>

Can confirm that this also happens on 8.8.0, and it is a changed behaviour from 8.7.x as far as we can see.

It is quite annoying behaviour, when I have closed all open alerts I would not expect to have the page update to show all the closed alerts but rather would expect an empty page.

We have several ongoing cases with elastic support on changed behavior in Security application so I am going to add this "feature" as well to one of these cases.

---

<div class="post-metadata">

**Author:** ![m-flow](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@m-flow](https://discuss.elastic.co/u/m-flow)\
**Post date:** [June 30, 2023, 6:46am UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909/4 "2023-06-30T06:46:34Z")

</div>

Thanks, that will help.

Generally the fix would be to show nothing, if there are no alerts with the status "open".

---

<div class="post-metadata">

**Author:** ![joean407](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@joean407](https://discuss.elastic.co/u/joean407)\
**Post date:** [July 17, 2023, 10:36am UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909/5 "2023-07-17T10:36:29Z")

</div>

Exactly, that is the behaviour I would expect as well. There seems to be more and more people who encounter this new behaviour, there is at least one more case in the discussion board. I have yet to receive any useful feedback on this from Elastic support unfortunately.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2023, 10:36am UTC](https://discuss.elastic.co/t/how-to-not-show-closed-alerts-in-the-alerts-overview/336909/6 "2023-08-14T10:36:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
