# Kibana Alerting : Need to include the hit count

**URL:** <https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135>\
**Category:** Kibana\
**Tags:** painless\
**Created:** [November 3, 2020, 10:32am UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135 "2020-11-03T10:32:48Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![naveen\_wilson](https://avatars.discourse-cdn.com/v4/letter/n/ecc23a/32.png) [@naveen\_wilson](https://discuss.elastic.co/u/naveen_wilson)\
**Post date:** [November 3, 2020, 10:32am UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/1 "2020-11-03T10:32:48Z")

</div>

Hi All,

I am configuring a Alert in Kibana. So in the alert, i need to add one more field for the count of errors. PFB the current Kibana message configured. I need to add the count of errors also in this. When i tried to use \*\* `{{ctx.results[0].hits.total}}` \*\* this, it is not showing the preview, also it was not triggering.  
Can anyone help me correct this.

```auto
> Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.
> - Trigger: {{ctx.trigger.name}}
> - Severity: {{ctx.trigger.severity}}
> - Period start: {{ctx.periodStart}}
> - Period end: {{ctx.periodEnd}}

```

---

<div class="post-metadata">

**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Post date:** [November 3, 2020, 4:35pm UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/2 "2020-11-03T16:35:46Z")

</div>

> [@naveen\_wilson](#):
>
> {{ctx.results[0].hits.total}}

Why do you use {{ctx.results[0].hits.total}} rather than {{ctx.payload.hits.total}} ?

---

<div class="post-metadata">

**Author:** ![naveen\_wilson](https://avatars.discourse-cdn.com/v4/letter/n/ecc23a/32.png) [@naveen\_wilson](https://discuss.elastic.co/u/naveen_wilson)\
**Post date:** [November 3, 2020, 4:50pm UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/4 "2020-11-03T16:50:12Z")

</div>

Hi,

i tried triggering the alert with {{ctx}}, to see the available values. But i couldnt find the payload in the list.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [November 3, 2020, 9:02pm UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/5 "2020-11-03T21:02:14Z")

</div>

Hi, I think you are using OpenDistro, and there is probably a dedicated forum for that.

---

<div class="post-metadata">

**Author:** ![gmmorris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gmmorris/32/72624_2.png) [@gmmorris](https://discuss.elastic.co/u/gmmorris)\
**Post date:** [November 3, 2020, 9:52pm UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/6 "2020-11-03T21:52:17Z")

</div>

Hi @naveen_wilson ,  
As Tim noted, looking at your configuration it looks like you're not in fact using Kibana's Alerting framework, but rather Amazon's OpenDistro for Elasticsearch.  
This is not the Elastic distribution of Kibana, but rather an Amazon specific product ([see the differences here](https://www.elastic.co/aws-elasticsearch-service)). We unfortunately cannot offer support for Amazon's distribution, so you may have better luck asking in their forums.

It's also worth noting that we do have an alerting feature as part of our distribution as well, which we are happy to offer support for: [https://www.elastic.co/what-is/kibana-alerting](https://www.elastic.co/what-is/kibana-alerting)

---

<div class="post-metadata">

**Author:** ![naveen\_wilson](https://avatars.discourse-cdn.com/v4/letter/n/ecc23a/32.png) [@naveen\_wilson](https://discuss.elastic.co/u/naveen_wilson)\
**Post date:** [November 4, 2020, 2:00am UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/7 "2020-11-04T02:00:53Z")

</div>

@gmmorris, @tsullivan Thank you for the replies.

Can you tell me is there anyway to confirm whether i am using open distro or Elastic distribution of Kibana. can i see it in Kibana?  
Please see the below link

> **[ELK Implementation for Hybris (SAP Commerce) - FAIR Consulting Group](https://faircg.com/blog/elk-implementation-for-hybris-sap-commerce/)**
>
> This article explains the need & implementation of ELK (Elasticsearch, Logstash, Kibana) stack for stashing and viewing logs of SAP Commerce.

  
we are actually using this in our project. I dont know that much about the underlaying Tech but still i have a strong feeling that we are not using Amazon's OpenDistro for Elasticsearch.  
We are using Kibana 6.7.1.  
Please let me know your thoughts!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 4, 2020, 5:33am UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/8 "2020-11-04T05:33:55Z")

</div>

Where did you download Elasticsearch from?

---

<div class="post-metadata">

**Author:** ![naveen\_wilson](https://avatars.discourse-cdn.com/v4/letter/n/ecc23a/32.png) [@naveen\_wilson](https://discuss.elastic.co/u/naveen_wilson)\
**Post date:** [November 4, 2020, 9:21am UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/9 "2020-11-04T09:21:25Z")

</div>

We dont have access to Elastic Search. This is like a bundle and managed by the Cloud Support team that is SAP Support. We only have access to Kibana.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 4, 2020, 9:40am UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/10 "2020-11-04T09:40:09Z")

</div>

As per screenshots it's the Basic version of Kibana  
Can you share a screenshot on how you create the alert in Kibana ? I'm not sure you use the alerting framework of Kibana, may be you use a custom plugin for alerting like ElastAlert or something else

---

<div class="post-metadata">

**Author:** ![naveen\_wilson](https://avatars.discourse-cdn.com/v4/letter/n/ecc23a/32.png) [@naveen\_wilson](https://discuss.elastic.co/u/naveen_wilson)\
**Post date:** [November 4, 2020, 3:06pm UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/11 "2020-11-04T15:06:02Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc5fe1eea3d9292953ce51b21437c79b73e0edc6.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a7eab9bfc1a8519a4c163a62302595273320b5d8.png)

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [November 4, 2020, 3:09pm UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/12 "2020-11-04T15:09:43Z")

</div>

This is openDistro

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2020, 9:52pm UTC](https://discuss.elastic.co/t/kibana-alerting-need-to-include-the-hit-count/254135/14 "2020-12-07T21:52:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
