# Notification of new instances of Metricbeat **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-monitoring, elastic-stack-alerting, metricbeat\ **Created:** [January 5, 2024, 5:06pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479 "2024-01-05T17:06:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![butchkelley](https://avatars.discourse-cdn.com/v4/letter/b/a4c791/32.png) [@butchkelley](https://discuss.elastic.co/u/butchkelley)\ **Post date:** [January 5, 2024, 5:06pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/1 "2024-01-05T17:06:02Z")
Hello, I have an 8.8.x Elastic deployment with ~1,000 instances of Metricbeat monitoring systems supporting few hundred products across our enterprise. Each instance of Metricbeat is auto-provisioned (not using Fleet) and is configured with a custom field called "product". I have a requirement to generate a notification when a new product is detected in our metricbeat indices or when an existing product is no longer being populated with data. My initial thought was I'll have to write external code to periodically (daily??) query my metricbeat indices to create a baseline list of products then periodically (hourly??) run new queries to compare with the baseline. Is this a reasonable approach? How would others tackle this? Could I somehow use Transforms to keep all the processing internal to Elastic? Thanks, Butch ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 5, 2024, 6:48pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/2 "2024-01-05T18:48:18Z")
Hi @butchkelley > [@butchkelley](#): > > Is this a reasonable approach? How would others tackle this? Could I somehow use Transforms to keep all the processing internal to Elastic? Great use case... Hmmm, let us think about this ... I have commonly used the latest transform to find when hosts, apps, and services go away, and it works great for that... I would need to think about how to use it for new... you could probably pretty easily detect the count increase. Identifying what is new might be more difficult. I will think about it. 🙂 ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 8, 2024, 3:48pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/3 "2024-01-08T15:48:29Z")
Hi @butchkelley A little more on this... > [@butchkelley](#): > > when an existing product is no longer being populated with data. This for sure you can do a latest transform group by hostname and timestamp for latest entry and then just alert when that last entry is older than say 24 hours (or whatever time you choose, I have done this many times it works great) > [@butchkelley](#): > > I have a requirement to generate a notification when a new product is detected in our metricbeat indices For this, I think you will need to use a pivot transform grouped by host.name and do a cardinality or value count on a field, and then alert on a difference or something. It is possible that you could use the pivot transform for both... If I get a chance, I will try to look more. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 8, 2024, 4:38pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/4 "2024-01-08T16:38:19Z")
> [@butchkelley](#): > > when an existing product is no longer being populated with data. This for sure you can do a latest transform group by hostname and timestamp for latest entry and then just alert when that last entry is older than say 24 hours (or whatever time you choose, I have done this many times it works great) > [@butchkelley](#): > > I have a requirement to generate a notification when a new product is detected in our metricbeat indices For this I think you will need to use a pivot transform grouped by host.name and do a cardinality or value count on a field and then alert on a difference or something. It is possible that you could use the pivot transform for both... If I get a chance, I will try to look more. Warning there is a Bug in the Transform UI which makes it very sluggish, it does work but the drop Down Lists can very frustrating... If you are good with the API you can create the Transform via API. Oops double post 🙂 ---
**Author:** ![butchkelley](https://avatars.discourse-cdn.com/v4/letter/b/a4c791/32.png) [@butchkelley](https://discuss.elastic.co/u/butchkelley)\ **Post date:** [January 8, 2024, 4:55pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/5 "2024-01-08T16:55:59Z")
Thanks Stephen, Yes, your "latest transform" suggestion sounds perfect for when product data is no longer coming in. As for new data, I created two pivot transforms with a group by of "product". One with a 1 min frequency and the other with an hourly frequency. My thought was to try and develop a Watcher that compares the two indices every mins or so and alert on the differences. In theory the hourly index would always lag behind the 1 min index. If this works then this should work for both new data and missing data. Unfortunately, my Watcher skills are a bit rusty so my challenge now is how to compare "products" in the 1-min index to "products" in the hourly index. Thanks for your help, Butch ---
**Author:** ![butchkelley](https://avatars.discourse-cdn.com/v4/letter/b/a4c791/32.png) [@butchkelley](https://discuss.elastic.co/u/butchkelley)\ **Post date:** [January 8, 2024, 5:15pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/6 "2024-01-08T17:15:19Z")
I may have a misunderstanding of how the pivot transforms work. Can you confirm whether or not pivot transforms only show current data? If old data stays in the index then my idea isn't going to work. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 8, 2024, 5:41pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/7 "2024-01-08T17:41:34Z")
> [@butchkelley](#): > > I may have a misunderstanding of how the pivot transforms work. Can you confirm whether or not pivot transforms only show current data? If old data stays in the index then my idea isn't going to work. Yes Pivot, Old data Stays ... you can manage how much, but I think the old data vs. new is how you will determine what is new. Last 5min I had 100 hosts now I have 101... You can detect that change... and better yet, I think you can identify which of the 101 is new... Think of Pivot as a Pivot every 10 Mins or something ... Pivot Chart over time... I think it is pretty powerful. I will try to take a look later this week if I get a chance and see if I can create something ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 5, 2024, 7:42pm UTC](https://discuss.elastic.co/t/notification-of-new-instances-of-metricbeat/350479/8 "2024-02-05T19:42:08Z")
Closed on February 5, 2024, 7:42pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.