# Kibana alert

**URL:** <https://discuss.elastic.co/t/kibana-alert/309415>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [July 12, 2022, 12:19pm UTC](https://discuss.elastic.co/t/kibana-alert/309415 "2022-07-12T12:19:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jathurshan\_Sumandira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jathurshan_sumandira/32/108118_2.png) [@Jathurshan\_Sumandira](https://discuss.elastic.co/u/Jathurshan_Sumandira)\
**Post date:** [July 12, 2022, 12:19pm UTC](https://discuss.elastic.co/t/kibana-alert/309415/1 "2022-07-12T12:19:54Z")

</div>

Hi Team,  
I am using Kibana alert rules and I used Elasticsearch query type.

{  
"query": {  
"bool": {  
"filter": {  
"script": {  
"script": " String alert = 'No alert';  
if(doc.containsKey('startTime') && doc['startTime'].size() \> 0 && doc.containsKey('endTime') && doc['endTime'].size() \> 0 && ((doc['endTime'].value.getMillis() - doc['startTime'].value.getMillis()) \> 60000) ){  
alert = 'start end Threshold Breach';  
}  
if(doc.containsKey('requestAt') && doc['requestAt'].size() \> 0 && doc.containsKey('responseAt') && doc['responseAt'].size() \> 0 && ((doc['responseAt'].value.getMillis() - doc['requestAt'].value.getMillis()) \> 60000) ){  
alert = 'request response Threshold Breach';  
}  
return (alert == 'start end Threshold Breach' || alert == 'request response Threshold Breach'); "  
}  
}  
}  
}  
}  
What I need is to add the alert variable (start end Threshold Breach, request response Threshold Breach) in my action  
My Document to index is like this  
{  
"alertAt": "{{context.date}}",  
"type": "test001",  
"message": """{{#context.hits}} Record Id is {{\_id}}, Record createdAt {{\_source.createdAt}} .  
{{/context.hits}}"""  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2022, 12:20pm UTC](https://discuss.elastic.co/t/kibana-alert/309415/2 "2022-08-09T12:20:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.