# Kibana Elastic Search Alerting not firing

**URL:** <https://discuss.elastic.co/t/kibana-elastic-search-alerting-not-firing/276401>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [June 18, 2021, 2:59pm UTC](https://discuss.elastic.co/t/kibana-elastic-search-alerting-not-firing/276401 "2021-06-18T14:59:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![scrappedprince](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scrappedprince/32/90527_2.png) [@scrappedprince](https://discuss.elastic.co/u/scrappedprince)\
**Post date:** [June 18, 2021, 2:59pm UTC](https://discuss.elastic.co/t/kibana-elastic-search-alerting-not-firing/276401/1 "2021-06-18T14:59:10Z")

</div>

0  
Hi All,

I am currently working on Kibana Alerting and what I wanted to perform is basically "Log threshold".  
Please see attached for the details of the alert rule.

 ![kibana alert](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a612387ec9e82345aed582900c7287c5e3274067.png)

I wanted to match phrase of the word "warnings" on the field "message". However, when i saved it, the alarm is not "Active" status went from active to OK. When i removed the AND message MATCHES PHRASE "warnings" that's when the alert is going to be in Active Status and is firing Anyone knows what is wrong with my ruling?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [June 29, 2021, 1:56pm UTC](https://discuss.elastic.co/t/kibana-elastic-search-alerting-not-firing/276401/2 "2021-06-29T13:56:07Z")

</div>

Is it possible you're trying to match a different field, and not `message`?

Have you tried using `matches` and not `matches phrase`?

The behavior you're seeing seems to indicate that it is finding docs matching the condition when it's "Active". When it changes to "OK" that means it is no longer active - but was previously (we will be renaming "OK" to "Recovered" in a future release).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2021, 1:56pm UTC](https://discuss.elastic.co/t/kibana-elastic-search-alerting-not-firing/276401/3 "2021-07-27T13:56:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.