# Kibana alerting: log threshold using OR

**URL:** <https://discuss.elastic.co/t/kibana-alerting-log-threshold-using-or/275496>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [June 9, 2021, 9:10pm UTC](https://discuss.elastic.co/t/kibana-alerting-log-threshold-using-or/275496 "2021-06-09T21:10:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tslattery](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@tslattery](https://discuss.elastic.co/u/tslattery)\
**Post date:** [June 9, 2021, 9:10pm UTC](https://discuss.elastic.co/t/kibana-alerting-log-threshold-using-or/275496/1 "2021-06-09T21:10:30Z")

</div>

Is it possible to create a log threshold condition that triggers if event.keyword is apConnectionLost OR event.keyword is apConnected? The UI is only allowing the AND operation.  
WHEN THE count OF LOG ENTRIES  
WITH event.keyword IS apConnectionLost  
AND event.keyword IS apConnected \<==== Looking for OR  
IS more than or equals 1  
FOR THE LAST 10 minutes  
GROUP BY apName.keyword

Thanks!

---

<div class="post-metadata">

**Author:** ![Aaron\_Caldwell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_caldwell/32/45755_2.png) [@Aaron\_Caldwell](https://discuss.elastic.co/u/Aaron_Caldwell)\
**Post date:** [June 9, 2021, 9:44pm UTC](https://discuss.elastic.co/t/kibana-alerting-log-threshold-using-or/275496/2 "2021-06-09T21:44:06Z")

</div>

Hello Terry,

You could try an `Elasticsearch query` alert if the `Index threshold` alert is too constraining. Here's a [link](https://www.elastic.co/guide/en/kibana/current/defining-alerts.html) to the docs which primarily focus on the threshold alert, but it all still mostly applies, just substitute the query you want to run for the threshold portions.

Regards,  
Aaron

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2021, 9:44pm UTC](https://discuss.elastic.co/t/kibana-alerting-log-threshold-using-or/275496/3 "2021-07-07T21:44:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.