# Monitor and alert on custom company windows services **URL:** \ **Category:** Elastic Observability\ **Tags:** elastic-stack-monitoring\ **Created:** [December 13, 2023, 12:28am UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202 "2023-12-13T00:28:08Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![CodeCraft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codecraft/32/130024_2.png) [@CodeCraft](https://discuss.elastic.co/u/CodeCraft)\ **Post date:** [December 13, 2023, 12:28am UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/1 "2023-12-13T00:28:08Z")
We need to monitor custom company windows services and send an alert when one of them stops. We have added the Windows Integration to the agent profile for the server that we want to monitor the Windows services on. We are using Fleet to manage our agent. We can see data in the "[Metrics Windows] Services dashboard", but our company created Windows services do not show up in the dashboard. How can we get our custom Windows services in the data stream and create an alert when one of them stops. Notes: I am new to Elastic. There was a similar topic, but no solution was provided. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 13, 2023, 1:33am UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/2 "2023-12-13T01:33:45Z")
Hi @CodeCraft Welcome to the community What version? When you go to Kibana Discover Can you find the service? Data View: `metrics-*` KQL bar : `windows.service.name : B` use the First letter or so of the service do you see it? Can you filter on it? Can you find the Documents? Example If that works we can work on an Alert.... ![Screenshot 2023-12-12 at 5.29.39 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba7af04570ed8994d486363d0c89b247a81f2cb7.png) ![Screenshot 2023-12-12 at 5.31.29 PM](https://us1.discourse-cdn.com/elastic/original/3X/5/6/561b06e0356aa853f7e3835cd7629546183ea124.jpeg) There is also Service Display Name... Can you find it? ![Screenshot 2023-12-12 at 5.33.17 PM](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b974024b1ce141411eb056329eeb7787b55b1286.png) ---
**Author:** ![CodeCraft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codecraft/32/130024_2.png) [@CodeCraft](https://discuss.elastic.co/u/CodeCraft)\ **Post date:** [December 13, 2023, 4:18pm UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/3 "2023-12-13T16:18:32Z")
Hi @stephenb Version: "8.11.1" (from "GET /" in Dev console ). I can find the service in Kibana Discover for both name and display name (When I filter on it I can see the name, or display name in the Document). ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 13, 2023, 8:00pm UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/4 "2023-12-13T20:00:27Z")
> [@CodeCraft](#): > > Version: "8.11.1" (from "GET /" in Dev console ). > > I can find the service in Kibana Discover for both name and display name (When I filter on it I can see the name, or display name in the Document). Ok > [@CodeCraft](#): > > How can we get our custom Windows services in the data stream and create an alert when one of them stops. So, the service IS in the data stream that is good; why it is not in the dashboard is unclear.. we can come back to that So you can now create an alert probably a couple of different ways. You can try this... Kibana - Stack Management - Rules -\> Create Rule Metric Threshold rule You can adjust the parameters... ```auto name: myservice-alert WHEN Document count IS BELOW OR EQUALS 5 FOR THE LAST 5 minutes Filter (optional) windows.service.state : Running and windows.service.name : yourserivename Group alerts by (optional) host.name ``` ![Screenshot 2023-12-13 at 11.56.54 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11c31f09605dc15a0338c4489b04e7bfc19fd199.png) ![Screenshot 2023-12-13 at 11.57.05 AM](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef81a21745acef02ea38a78dafeadd680237a341.png) ---
**Author:** ![CodeCraft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codecraft/32/130024_2.png) [@CodeCraft](https://discuss.elastic.co/u/CodeCraft)\ **Post date:** [December 13, 2023, 11:52pm UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/5 "2023-12-13T23:52:32Z")
Hi @stephenb. I added the alert as per your instructions (except the "Create alert" button did not exist and seems to be called "Create rule" now). I also added an action so it would send an email when the alert is triggered. I can't properly test the condition at this time, as once the alert went active it never goes inactive, and I can't find a way to acknowledge the alert... ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 14, 2023, 12:44am UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/6 "2023-12-14T00:44:17Z")
> [@CodeCraft](#): > > except the "Create alert" button did not exist and seems to be called "Create rule" now Yup sorry Rule, we used to call it Alert > [@CodeCraft](#): > > I also added an action so it would send an email when the alert is triggered. I can't properly test the condition at this time, as once the alert went active it never goes inactive, and I can't find a way to acknowledge the alert... You don't really Acknowledge the Alert ... Usually you set it to Notify on Status Change which means 1 Notification when the condition is met... ![Screenshot 2023-12-13 at 4.37.10 PM](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6bfad08941ac99ee9b49eb88ed90c2e80814c5ce.png) and then you set an action when the alert is Recovered ![Screenshot 2023-12-13 at 4.39.25 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/6/0602bc905f1c20d6fc704acfa2c6e2d1e58cbd91.png) You can Snooze or "Mute" the alert if you want in the Rules management Page ![Screenshot 2023-12-13 at 4.43.23 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/3/439ee1978178349e38e4850ab7e171feb8613beb.png) You should probably take a look at the docs... > **[Alerting | Elastic Observability \[8.11\] | Elastic](https://www.elastic.co/guide/en/observability/current/create-alerts.html)** ---
**Author:** ![CodeCraft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codecraft/32/130024_2.png) [@CodeCraft](https://discuss.elastic.co/u/CodeCraft)\ **Post date:** [December 14, 2023, 8:07pm UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/7 "2023-12-14T20:07:37Z")
Hi @stephenb The problem was that the alert was never recovering. It turned out to be a flaw in your logic for the condition. When it’s set to “IS BELOW OR EQUALS 5” the alert never recovers. The logic that works is: “IS BELOW 5”. The alert seems to be working as expect now. Thanks for the help. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 14, 2023, 8:38pm UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/8 "2023-12-14T20:38:31Z")
Glad you got it working > [@CodeCraft](#): > > When it’s set to “IS BELOW OR EQUALS 5” th That was just a sample condition ... I did not mean that as exact / literal 🙂 ---
**Author:** ![CodeCraft](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/codecraft/32/130024_2.png) [@CodeCraft](https://discuss.elastic.co/u/CodeCraft)\ **Post date:** [December 14, 2023, 9:12pm UTC](https://discuss.elastic.co/t/monitor-and-alert-on-custom-company-windows-services/349202/9 "2023-12-14T21:12:01Z")
Lol. Kind of figured. Thanks!