# How to setup a threshold alert for count of one specific type of value on keyword field

**URL:** <https://discuss.elastic.co/t/how-to-setup-a-threshold-alert-for-count-of-one-specific-type-of-value-on-keyword-field/171170>\
**Category:** Kibana\
**Created:** [March 6, 2019, 5:53pm UTC](https://discuss.elastic.co/t/how-to-setup-a-threshold-alert-for-count-of-one-specific-type-of-value-on-keyword-field/171170 "2019-03-06T17:53:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gmazza](https://avatars.discourse-cdn.com/v4/letter/g/82dd89/32.png) [@gmazza](https://discuss.elastic.co/u/gmazza)\
**Post date:** [March 6, 2019, 5:53pm UTC](https://discuss.elastic.co/t/how-to-setup-a-threshold-alert-for-count-of-one-specific-type-of-value-on-keyword-field/171170/1 "2019-03-06T17:53:28Z")

</div>

I am trying to create a threshold alert for a keyword field called status

The status field has 3 possible values  
Suspended  
Rejected  
Warning

Well I do not care for Warnings

I would like alerts for count of Status =  
Suspended \> 1 in the last 5 minutes  
Rejected \> 10 in the last 5 minutes

Using the GUI In Kibana for creating threshold alerts  
it seems I cannot filter out the results i want and focus the alert to fire only when one type of status is bigger that the threshold.

if there is away on just focus on the key = Rejected only instead of putting all 3 types status together?

Here is a sample of the email i get i put the whole payload into it the body to see the available info

Too many Rejections in the last 5 min  
[{name=hl7-rejections, watcherui={trigger\_interval\_unit=m, agg\_type=count, time\_field=@timestamp, trigger\_interval\_size=1, term\_size=3, time\_window\_unit=m, threshold\_comparator=\>, term\_field=status, index=[hl7log\*], time\_window\_size=5, threshold=6, agg\_field=null}, xpack={type=threshold}}] [{results=[{value=11, key=Warning}, {value=7, key=Rejected}]}]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 3, 2019, 5:53pm UTC](https://discuss.elastic.co/t/how-to-setup-a-threshold-alert-for-count-of-one-specific-type-of-value-on-keyword-field/171170/2 "2019-04-03T17:53:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.