# Is ELK itself capable of keeping track of certain events & alerting? **URL:** \ **Category:** Logstash\ **Created:** [June 23, 2020, 5:33am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188 "2020-06-23T05:33:21Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Aj\_t](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Post date:** [June 23, 2020, 5:33am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188/1 "2020-06-23T05:33:21Z")
I realize that the question is super vague, but here's what I am trying to do. I've already set up ELK and am sending some logs via Filebeat to the ELK server. What I ultimately want to do is a proof of concept system that will do the following: - capture and store certain parts/lines of a log file - keep track of the number of times that line(s) is repeated during a certain window - send out alerts if that happened more than x number of times I am super new to ELK and not at all sure if this can be accomplished by ELK itself or I am going to need a fully fledged Java program or something on top of the ELK set up? Thank you! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 23, 2020, 6:02am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188/2 "2020-06-23T06:02:28Z")
Yes, that is something you can do with the stack 🙂 ---
**Author:** ![Aj\_t](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Post date:** [June 23, 2020, 6:07am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188/3 "2020-06-23T06:07:31Z")
If you don't mind - so this will be done at the Logstash level? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 23, 2020, 6:11am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188/4 "2020-06-23T06:11:17Z")
Going through your 3 points; - Logstash can do this filtering, as can Beats, even Elasticsearch. Just pick whatever is easiest - Elasticsearch does that at query time (see next) - Alerting has a bunch of [free functionality](https://www.elastic.co/blog/introducing-the-new-alerting-framework-for-observability-security-and-the-elastic-stack), and this would cover your 2nd point about tracking N things over X timespan and doing something ---
**Author:** ![Aj\_t](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Post date:** [June 23, 2020, 6:25am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188/5 "2020-06-23T06:25:57Z")
Thanks, Mark! I obviously need to do more reading, but thank you for pointing me in the right direction. I do want to clarify something though - if I set up a query at the Elasticsearch level to run say, every minute - that's what going to keep track of my lines, right (my 2nd requirement)? You mentioned alerting will cover my 2nd point, so I wasn't sure which part of the stack will help with each of my requirements. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 21, 2020, 6:26am UTC](https://discuss.elastic.co/t/is-elk-itself-capable-of-keeping-track-of-certain-events-alerting/238188/6 "2020-07-21T06:26:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.