# Monitor rule to detect failed pods

**URL:** <https://discuss.elastic.co/t/monitor-rule-to-detect-failed-pods/379106>\
**Category:** Elasticsearch\
**Created:** [June 11, 2025, 7:43pm UTC](https://discuss.elastic.co/t/monitor-rule-to-detect-failed-pods/379106 "2025-06-11T19:43:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcelpineda](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@marcelpineda](https://discuss.elastic.co/u/marcelpineda)\
**Post date:** [June 11, 2025, 7:43pm UTC](https://discuss.elastic.co/t/monitor-rule-to-detect-failed-pods/379106/1 "2025-06-11T19:43:04Z")

</div>

I am trying to define Monitoring rule to detect pod status=failed.  
I've used Discover and the parameters below:  
**Data view:** pod-status-ad-hoc  
**Filter:** metrics.k8s.pod.phase: exists  
**Query:** ( ( "failed": \* ) AND ( "resource.attributes.k8s.pod.name": \* ) )

It returns 3 pods in failed status.

 ![discover_1](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6cee892f2a56f64ac5853a1a0c7c6c0c5f01e31a.jpeg)

If I go to Alerts \> Create search threshold rule, it opens the ‘Create Rule’ for Rule type = Elasticsearch query, populates data view, query and filter.  
As a result, it will alert for the number of entries for pod 'failed'.  
Instead of counting the number of documents, what I’d like to do is generate an alert for each pod that is in ‘failed’ status.

I could not find a way to implement this type of monitoring rule. Any suggestion? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 11, 2025, 8:14pm UTC](https://discuss.elastic.co/t/monitor-rule-to-detect-failed-pods/379106/2 "2025-06-11T20:14:32Z")

</div>

Hi @marcelpineda Welcome to the community.

What version are you on?

Custom Threshold rule (super powerful/ flexible)  
Same filter  
Same condition  
Group by pod name

> **[Create a custom threshold rule | Elastic Docs](https://www.elastic.co/docs/solutions/observability/incident-management/create-custom-threshold-rule)**
>
> Create a custom threshold rule to trigger an alert when an Elastic Observability Serverless data type reaches or exceeds a given value. To access this...