# Kibana: alert with various fields

**URL:** <https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [May 24, 2021, 10:08am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809 "2021-05-24T10:08:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Guillermo\_Valles\_Cas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guillermo_valles_cas/32/87769_2.png) [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)\
**Post date:** [May 24, 2021, 10:08am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809/1 "2021-05-24T10:08:46Z")

</div>

This is my scenario: I have two fields (A and B) and I would like to create an alert where if sum(A+B) \> 90% (or A / B \> 1) should trigger the alert. It is possible to do that with alerts with Kibana?

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [May 27, 2021, 12:47am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809/2 "2021-05-27T00:47:34Z")

</div>

Hi, you can do this with [runtime fields](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/runtime.html).

Create a runtime field, for example called `ab_sum`, in your metrics data that calculates the sum of the two fields. Then [create a rule definition](https://www.elastic.co/guide/en/kibana/7.13/defining-alerts.html#defining-alerts) of an [index threshold](https://www.elastic.co/guide/en/kibana/7.13/rule-type-index-threshold.html) rule type that alerts when the calculated field is greater than 0.9.

As the example of how to define the rule, the `when` and `threshold` may look like:

- When: `max() of "ab_sum"`
- Threshold: `is above 0.90`

---

<div class="post-metadata">

**Author:** ![Guillermo\_Valles\_Cas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guillermo_valles_cas/32/87769_2.png) [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)\
**Post date:** [June 1, 2021, 6:36am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809/3 "2021-06-01T06:36:09Z")

</div>

> [@tsullivan](#):
>
> Create a runtime field, for example called `ab_sum` , in your metrics data that calculates the sum of the two fields

Would this script create that new field?

```
PUT my-index-000001/
{
  "mappings": {
    "runtime": {
      "ab_sum": {
        "type": "keyword",
        "script": {
          "source": "['a'].value + ['b'].value"
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [June 9, 2021, 12:03am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809/4 "2021-06-09T00:03:41Z")

</div>

- The `type` should be `long` - not `keyword`
- The `script` should use the `emit` method to emit calculated values: [Map a runtime field | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/runtime-mapping-fields.html)

Example:

```auto
      "runtime": {
        "ab_sum": {
          "type": "long",
          "script": {
            "source": "emit(doc['field_a'].value + doc['field_b'].value)"
          }
        }
      }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2021, 12:03am UTC](https://discuss.elastic.co/t/kibana-alert-with-various-fields/273809/5 "2021-07-07T00:03:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.