# How to write alert rule in Elastalert

**URL:** <https://discuss.elastic.co/t/how-to-write-alert-rule-in-elastalert/147575>\
**Category:** Elasticsearch\
**Created:** [September 6, 2018, 12:59pm UTC](https://discuss.elastic.co/t/how-to-write-alert-rule-in-elastalert/147575 "2018-09-06T12:59:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pradnya](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@Pradnya](https://discuss.elastic.co/u/Pradnya)\
**Post date:** [September 6, 2018, 12:59pm UTC](https://discuss.elastic.co/t/how-to-write-alert-rule-in-elastalert/147575/1 "2018-09-06T12:59:12Z")

</div>

I have configured metricbeat-Elasticsearch-kibana to monitor docker containers metric. and Elastalert to get email alert.  
I am getting CPU, memory, Network usage perfectly.  
and getting docker container status as field: "docker.container.status"= Up 5 min"  
need to get alert in Elastalert when container will get stopped or paused.  
It will be great if anyone can help me to write elastalert rule to get alert.

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [September 15, 2018, 3:55pm UTC](https://discuss.elastic.co/t/how-to-write-alert-rule-in-elastalert/147575/2 "2018-09-15T15:55:01Z")

</div>

This forum is about software developed by Elastic. Elastalert is a third-party, so you might not get much help here.

I suggest that you try another forum such as Stackoverflow.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2018, 3:55pm UTC](https://discuss.elastic.co/t/how-to-write-alert-rule-in-elastalert/147575/3 "2018-10-13T15:55:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
