# No data Alert **URL:** \ **Category:** Kibana\ **Created:** [July 13, 2023, 10:52am UTC](https://discuss.elastic.co/t/no-data-alert/338315 "2023-07-13T10:52:29Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 13, 2023, 10:52am UTC](https://discuss.elastic.co/t/no-data-alert/338315/1 "2023-07-13T10:52:29Z")
Hi Team, We want to create alert if no data is receiving is from last 15 minute. We have tried with the watcher it worked for us but we can't go as in watcher the alert status does not change like as in alert we have active , recover options we have. I tried with Index Threshold alert but i can't able to create it. Please if any one has solution update me here ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [July 18, 2023, 2:01pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/2 "2023-07-18T14:01:21Z")
This setup worked for me. I could get my alert triggered and recovered as my `metricbeat` was sending data or not to my cluster. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/a/ca66b4d3b5201ec37be423172f4b3a69cd57e4ca.png) And on the history of the alert it shows when it was triggered and recovered ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/2194fc8f0c811640ae8a2ca44c861d21558304bc.png) What was not working for you? ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 18, 2023, 2:33pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/3 "2023-07-18T14:33:31Z")
We have deployed metricbeat in almost 300 servers and if somehow metricbeat is stop in one server then we should get alert " metricbeat is stopped in xx.xx.xx.xx" ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [July 18, 2023, 3:00pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/4 "2023-07-18T15:00:48Z")
There is a grouping capability on the threshold index > **Over/Grouped Over** > > Specify whether the aggregation is applied over all documents or split into groups using a grouping field. If grouping is used, an [alert](https://www.elastic.co/guide/en/kibana/8.8/alerting-getting-started.html#alerting-concepts-alerts) will be created for each group when it exceeds the threshold. To limit the number of alerts on high cardinality fields, you must specify the number of groups to check against the threshold. Only the top groups are checked. > **[Index threshold | Kibana Guide \[8.8\] | Elastic](https://www.elastic.co/guide/en/kibana/8.8/rule-type-index-threshold.html)** On my example: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/4/845511d8f79f10d8c1120776073ace10e46d4938.png) I haven't an environment like yours to test so I'm talking from a very limited experience. ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 18, 2023, 3:06pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/5 "2023-07-18T15:06:51Z")
Thanks @jsanz let me try this because in kibana Alert i don't we can customer message as i mention we can show metricbeat is stopped in xx.xx.xx.xx. it should automatically take host.hostname value from the document. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 19, 2023, 4:46am UTC](https://discuss.elastic.co/t/no-data-alert/338315/6 "2023-07-19T04:46:41Z")
What Version of the Stack? Metric threshold have missing data alerts built in....Recent versions which report when the data is missing ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 20, 2023, 6:49am UTC](https://discuss.elastic.co/t/no-data-alert/338315/7 "2023-07-20T06:49:03Z")
7.17 ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 24, 2023, 11:20am UTC](https://discuss.elastic.co/t/no-data-alert/338315/8 "2023-07-24T11:20:19Z")
Hi Team, We are now getting the alert but we need to modify the message body.We are getting this alert on mail In mail we are getting alert like this ```auto Alert: No Hits observed in xx.xx.xx.xx in the last 10m IP_Address: xx.xx.xx.xx State: ALERT -- This message was sent by Kibana. View rule in Kibana. ``` But in kibana email connector we have set like this ```auto Alert: No Hits observed in {{context.group}} in the last 10m IP_Address: {{context.group}} State: {{context.alertState}} ``` We are getting messages on email as a single line , it is not coming as multiline ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 24, 2023, 3:20pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/9 "2023-07-24T15:20:29Z")
> [@Aniket\_Pant](#): > > ```auto > Alert: No Hits observed in {{context.group}} in the last 10m > IP_Address: {{context.group}} > State: {{context.alertState}} > > ``` Perhaps try another line in between ```auto Alert: No Hits observed in {{context.group}} in the last 10m IP_Address: {{context.group}} State: {{context.alertState}} ``` ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 24, 2023, 4:27pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/10 "2023-07-24T16:27:32Z")
Thanks @stephenb , Could you please tell me whether this possible or not Can we get alert for status change like that particular node who was not sending the logs , is now sending the logs ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 24, 2023, 5:22pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/11 "2023-07-24T17:22:12Z")
Need more info. What Version are you on? Can you show the complete setup of the alert? as @jsanz explained above you can be alerted when data stops and "recovered" when it continues... did you try / test his suggestion? The group by field is what you will use to look by node... you just need to group by that field that represents your node name ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 24, 2023, 5:36pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/12 "2023-07-24T17:36:20Z")
Hi @stephenb , We are using 7.17.5 ELK cluster and it is working i mean we are getting the alert but when a alert is recovered how can we get alert for this also in kibana UI we can see it is now fine application is sending the logs but we need a alert also if status is changed to recover I will share you the alert info ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 24, 2023, 6:48pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/13 "2023-07-24T18:48:45Z")
You need to set up another action for Recoverd ... that is the way you do it 1 Action for Threshold Met 1 Acgtion for Recovered ![Screenshot 2023-07-24 at 11.48.18 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f3236495abfd5f0f7d28f29ab2295fcc3cd60971.png) ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 27, 2023, 4:50am UTC](https://discuss.elastic.co/t/no-data-alert/338315/14 "2023-07-27T04:50:29Z")
Hi @stephenb , yesterday we got alert you can see below ```auto Alert: No Hits observed in xx.xx.xx.xx in the last 10m IP_Address: xx.xx.xx.xx State: ALERT -- This message was sent by Kibana. View rule in Kibana. ``` and when it was recovered , in the alert recovered message we didn't get any server ip and alert state ```auto Alert: (Clear/Reset) Hits now observed in the last 10m IP_Address: State: -- This message was sent by Kibana. View rule in Kibana. ``` ![clear](https://us1.discourse-cdn.com/elastic/original/3X/9/2/92b30eb5c89107621e537223952fa9b20505beb0.png) We are need to get alert when state is Alert and Recovered do i need to have seperate condition for recovered ? ![condition](https://us1.discourse-cdn.com/elastic/original/3X/c/8/c86cc965c6003895d353fe2749d165b8fae0a8af.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 27, 2023, 5:09am UTC](https://discuss.elastic.co/t/no-data-alert/338315/15 "2023-07-27T05:09:24Z")
1 condition with 2 Actions Alert and Recovered It is hard to tell your set up as you don't show the complete screens What version are you on? The recovered data was only added in fairly recent versions. ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 27, 2023, 6:16am UTC](https://discuss.elastic.co/t/no-data-alert/338315/16 "2023-07-27T06:16:29Z")
Hi @stephenb , > What version are you on? The recovered data was only added in fairly recent versions. 7.17.5 I have attached Screenshots you can check is there something i am doing wrong **Screenshot-1** ![Screenshot-1](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc61c88542d56107a4e0207e3f4d2b16f8c1c2cd.png) **Screenshot-2** ![Screenshot-2](https://us1.discourse-cdn.com/elastic/original/3X/d/b/db2c2e30a96fa281e295cef5825e430ddd499406.png) **Screenshot-3** ![Screenshot-3](https://us1.discourse-cdn.com/elastic/original/3X/2/5/253311c3862e3b323aec6cedf80ab7824637d7ee.png) **Screenshot-4** ![Screenshot-4](https://us1.discourse-cdn.com/elastic/original/3X/3/8/38d0cabfb65be5bffa22ab6988ea06021df72d87.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 27, 2023, 2:00pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/17 "2023-07-27T14:00:20Z")
Hi @Aniket_Pant Unfortunately, the feature context for recovered alerts did not come until 8.5 I believe so that is probably why it is missing in 7.17 You can always test the full message by just putting `{{context}}` into the Message to see what is all there, I think you will find it blank in 7.17 and fully populated from 8.5 on ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 27, 2023, 5:08pm UTC](https://discuss.elastic.co/t/no-data-alert/338315/18 "2023-07-27T17:08:02Z")
Thank you @stephenb and @jsanz for your support we will plan to upgrade ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [July 28, 2023, 9:27am UTC](https://discuss.elastic.co/t/no-data-alert/338315/19 "2023-07-28T09:27:40Z")
we need to upgrade to 8.5 correct ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2023, 9:27am UTC](https://discuss.elastic.co/t/no-data-alert/338315/20 "2023-08-25T09:27:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.