Monitor and alert on custom company windows services

We need to monitor custom company windows services and send an alert when one of them stops.

We have added the Windows Integration to the agent profile for the server that we want to monitor the Windows services on. We are using Fleet to manage our agent. We can see data in the "[Metrics Windows] Services dashboard", but our company created Windows services do not show up in the dashboard.

How can we get our custom Windows services in the data stream and create an alert when one of them stops.

I am new to Elastic.
There was a similar topic, but no solution was provided.

Hi @CodeCraft Welcome to the community

What version?

When you go to Kibana Discover
Can you find the service?

Data View: metrics-*

KQL bar : : B use the First letter or so of the service do you see it?

Can you filter on it? Can you find the Documents?


If that works we can work on an Alert....

There is also Service Display Name... Can you find it?

Hi @stephenb

Version: "8.11.1" (from "GET /" in Dev console ).

I can find the service in Kibana Discover for both name and display name (When I filter on it I can see the name, or display name in the Document).


So, the service IS in the data stream that is good; why it is not in the dashboard is unclear.. we can come back to that

So you can now create an alert probably a couple of different ways.

You can try this...

Kibana - Stack Management - Rules -> Create Rule

Metric Threshold rule

You can adjust the parameters...

name: myservice-alert 

WHEN Document count IS BELOW OR EQUALS 5

FOR THE LAST 5 minutes

Filter (optional)
windows.service.state : Running and : yourserivename

Group alerts by (optional)

Hi @stephenb.

I added the alert as per your instructions (except the "Create alert" button did not exist and seems to be called "Create rule" now). I also added an action so it would send an email when the alert is triggered. I can't properly test the condition at this time, as once the alert went active it never goes inactive, and I can't find a way to acknowledge the alert...

Yup sorry Rule, we used to call it Alert

You don't really Acknowledge the Alert ...

Usually you set it to Notify on Status Change which means 1 Notification when the condition is met...

and then you set an action when the alert is Recovered

You can Snooze or "Mute" the alert if you want in the Rules management Page

You should probably take a look at the docs...

Hi @stephenb

The problem was that the alert was never recovering. It turned out to be a flaw in your logic for the condition. When it’s set to “IS BELOW OR EQUALS 5” the alert never recovers. The logic that works is: “IS BELOW 5”. The alert seems to be working as expect now.

Thanks for the help.

Glad you got it working

That was just a sample condition ... I did not mean that as exact / literal :slight_smile:

Lol. Kind of figured.