# Inventory Alerting - More than 1 alerts for same hosts

**URL:** <https://discuss.elastic.co/t/inventory-alerting-more-than-1-alerts-for-same-hosts/379103>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [June 11, 2025, 5:36pm UTC](https://discuss.elastic.co/t/inventory-alerting-more-than-1-alerts-for-same-hosts/379103 "2025-06-11T17:36:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [June 11, 2025, 5:36pm UTC](https://discuss.elastic.co/t/inventory-alerting-more-than-1-alerts-for-same-hosts/379103/1 "2025-06-11T17:36:45Z")

</div>

Hello,

I am on Kibana/ES: v8.18.0  
It appears that I created a memory usage Inventory alert.

It works as expected until I notice 2 alerts pop up for the same host:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e96c276755b30b1f67030f4bf0058f2df8b192ba.png)

Shouldn't it be one alert and until that recovers then alert a new one?  
The alert frequency is set as "on status changes", it appears it creates a new alert for "Flapping"

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [June 12, 2025, 11:14am UTC](https://discuss.elastic.co/t/inventory-alerting-more-than-1-alerts-for-same-hosts/379103/2 "2025-06-12T11:14:44Z")

</div>

Hello @erikg

### Why Does an Active Alert Still Exist While Flapping?

1. **Flapping is a Meta-State, Not a Replacement for Active**

- When an alert is flapping, Kibana **does not immediately recover the Active alert**.
- Instead, it marks the alert as flapping because it keeps switching between Active and Recovered within a defined threshold.

1. **Flapping Detection Works Separately from Active Status**

- Kibana tracks how often an alert changes state. If it meets the flapping criteria (e.g., switching 6 times in 10 runs), it gets an additional **Flapping** status.
- However, if the condition that originally triggered the **Active** alert is still met, the alert remains **Active**.

1. **New Alert Entry for Flapping**

- Kibana sometimes creates a separate alert entry for flapping detection instead of modifying the original alert.
- This happens because flapping is an **alert behavior** , not a direct status change.

Thanks!!

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [June 12, 2025, 1:44pm UTC](https://discuss.elastic.co/t/inventory-alerting-more-than-1-alerts-for-same-hosts/379103/3 "2025-06-12T13:44:29Z")

</div>

@Tortoise thanks for the clarification.

I think regardless of the flapping condition, the inventory rule (for memory) is generating duplicates:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1fd8e870cb636a69dd17dfd8eb31b5d809f82afb.png)

Above screenshot shows two active alerts coming from the same host, there should only be one if the initial alert has and is active.