# Node down alert

**URL:** <https://discuss.elastic.co/t/node-down-alert/317946>\
**Category:** Elasticsearch\
**Created:** [November 2, 2022, 5:56am UTC](https://discuss.elastic.co/t/node-down-alert/317946 "2022-11-02T05:56:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [November 2, 2022, 5:56am UTC](https://discuss.elastic.co/t/node-down-alert/317946/1 "2022-11-02T05:56:13Z")

</div>

Hi Community,

I am using ELK cluster version 7.17. I need to get alert if a node goes down for a particular duration like 5 minute. I am using metricbeat to monitor cluster. How can we achieve this.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 2, 2022, 11:08pm UTC](https://discuss.elastic.co/t/node-down-alert/317946/2 "2022-11-02T23:08:26Z")

</div>

You can yes, take a look at [Kibana alerts | Kibana Guide [8.5] | Elastic](https://www.elastic.co/guide/en/kibana/current/kibana-alerts.html), specifically [this one](https://www.elastic.co/guide/en/kibana/current/kibana-alerts.html#kibana-alerts-missing-monitoring-data).

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [November 3, 2022, 2:11am UTC](https://discuss.elastic.co/t/node-down-alert/317946/3 "2022-11-03T02:11:41Z")

</div>

Node does not mean elastic. If we are monitoring Linux server if the server or system goes down then we should get alert.

In kibana alerting is there any option that we can select any specific index like metricbeat.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 3, 2022, 3:05am UTC](https://discuss.elastic.co/t/node-down-alert/317946/4 "2022-11-03T03:05:57Z")

</div>

Did you look at [Alerting | Kibana Guide [8.11] | Elastic](https://www.elastic.co/guide/en/kibana/current/alerting-getting-started.html)?

> [@Aniket\_Pant](#):
>
> Node does not mean elastic

It does here 😉

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [November 3, 2022, 6:08am UTC](https://discuss.elastic.co/t/node-down-alert/317946/5 "2022-11-03T06:08:29Z")

</div>

Hi @warkolm

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f40dc09583c2125dde2c611d4e27b23e77dd2c5e.png)

There is no option showing of selecting metricbeat index.

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [November 3, 2022, 6:11am UTC](https://discuss.elastic.co/t/node-down-alert/317946/6 "2022-11-03T06:11:02Z")

</div>

I finded it.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/345f3716af3c76336fdb5344fd1132212c9f996f.png)

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [November 3, 2022, 9:27am UTC](https://discuss.elastic.co/t/node-down-alert/317946/7 "2022-11-03T09:27:52Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8b8da1e02cdd15a198ce10da1488f9247aeb0953.png)

Query:

```auto
{

  "query":
  {
      "bool":
      {
        "filter":[
        {
            "term":
            {
                "metricset.name": "uptime"
            }
      },
      {
          "range":
          {
              "lt":
              {
                  "system.uptime.duration.ms": 0
              }
          }
      }
      ]
  }
}
}

```

Hi @warkolm i created a query , it is checking system.uptime if is it less than 0 it would give result  
But i dont understand **When number of matches** in above pic.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2022, 9:28am UTC](https://discuss.elastic.co/t/node-down-alert/317946/8 "2022-12-01T09:28:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.