# How to set alert on total size of indices matching a pattern?
**URL:** https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [April 17, 2023, 6:37pm UTC](https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159 "2023-04-17T18:37:42Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ppine7](https://discuss.elastic.co/u/ppine7)
#### Post date: [April 17, 2023, 6:37pm UTC](https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159/1 "2023-04-17T18:37:42Z")
Hi!
I've posted this question on SO: [elastic stack - Elasticsearch how to set alert on total size of indices matching a pattern? - Stack Overflow](https://stackoverflow.com/questions/76035746/elasticsearch-how-to-set-alert-on-total-size-of-indices-matching-a-pattern) but am re-posting it here in hopes to get a more focused audience ๐
I would like to set an Alert Rule in Elastic - to trigger an alert when a total size of indices, matching a specific pattern, exceeds some limit.
I know how to get the total size by running a query:
```auto
GET /.ds-elastic-cloud-logs*/_stats
```
this would give me:
```auto
...
"_all": {
"primaries": {
"docs": {
"count": 12865686,
"deleted": 0
},
"shard_stats": {
"total_count": 5
},
"store": {
"size_in_bytes": 2205540490,
"total_data_set_size_in_bytes": 2205540490,
"reserved_in_bytes": 0
},
...
```
and the value I'm looking for is: **"size\_in\_bytes": 2205540490**
But I could not find how to create an alert based on this value...
I looked at the "index threshold" type of alerts: [Index threshold | Kibana Guide [master] | Elastic](https://www.elastic.co/guide/en/kibana/master/rule-type-index-threshold.html) - and while I am able to specify the index pattern (.ds-elastic-cloud-logs\*) in the rule - the "size-in-bytes" field is not available for use in the alert...
Also looked at the "elasticsearch query" type of alerts: [Elasticsearch query | Kibana Guide [master] | Elastic](https://www.elastic.co/guide/en/kibana/master/rule-type-es-query.html) - but I can only get a count of documents returned by a query to be used as the metric, not the size of indices ...
Any other way to achieve what I want?
Thank you!
Marina
---
### Author:  [@grfneto](https://discuss.elastic.co/u/grfneto)
#### Post date: [April 17, 2023, 9:20pm UTC](https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159/2 "2023-04-17T21:20:26Z")
Hi @ppine7
Have you tried to create a pipeline that gets information from the \_stats API and saves it in another index? In this other index that will make the storage summary, you can create an alert for the desired field. Another possibility, if applicable to your scenario, is the use of ILM to manage your index storage and perform the rollup.
[ILM: Manage the index lifecycle | Elasticsearch Guide [8.7] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/index-lifecycle-management.html)
Best regards
---
### Author:  [@vincenbr](https://discuss.elastic.co/u/vincenbr)
#### Post date: [April 17, 2023, 9:58pm UTC](https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159/3 "2023-04-17T21:58:54Z")
Hi,
I am afraid you cannot (at least for now) call an arbitrary API with Kibana alert Rules.
I would go with the [Watcher](https://www.elastic.co/guide/en/elasticsearch/reference/current/input-http.html), which is more flexible. You could get inspiration from sample Watches repo, like this one: [examples/Alerting/Sample Watches/large\_shard\_watch at master ยท elastic/examples ยท GitHub](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/large_shard_watch)
---
### Author:  [@ppine7](https://discuss.elastic.co/u/ppine7)
#### Post date: [April 18, 2023, 1:48pm UTC](https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159/4 "2023-04-18T13:48:46Z")
Thank you, @grfneto ! I was looking for something out of the box for Alerts - will keep this option in mind too. And I do use ILM - but wanted to add alerts as a precaution as well.
---
### Author:  [@ppine7](https://discuss.elastic.co/u/ppine7)
#### Post date: [April 18, 2023, 1:50pm UTC](https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159/5 "2023-04-18T13:50:14Z")
Thank you, @vincenbr ! I was hoping to have an out-of-the-box option like that for Alerts - will keep the Watch approach in mind - although as I checked the GIT repo example - it does look quite intimidating ๐
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 16, 2023, 1:50pm UTC](https://discuss.elastic.co/t/how-to-set-alert-on-total-size-of-indices-matching-a-pattern/330159/6 "2023-05-16T13:50:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.