# NTP server time sync issue - how to write alerts (Query DSL )

**URL:** <https://discuss.elastic.co/t/ntp-server-time-sync-issue-how-to-write-alerts-query-dsl/378006>\
**Category:** Elasticsearch\
**Created:** [May 10, 2025, 7:28am UTC](https://discuss.elastic.co/t/ntp-server-time-sync-issue-how-to-write-alerts-query-dsl/378006 "2025-05-10T07:28:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jt2023](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jt2023/32/123449_2.png) [@jt2023](https://discuss.elastic.co/u/jt2023)\
**Post date:** [May 10, 2025, 7:28am UTC](https://discuss.elastic.co/t/ntp-server-time-sync-issue-how-to-write-alerts-query-dsl/378006/1 "2025-05-10T07:28:14Z")

</div>

NTP server time sync issue

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 10, 2025, 8:50am UTC](https://discuss.elastic.co/t/ntp-server-time-sync-issue-how-to-write-alerts-query-dsl/378006/2 "2025-05-10T08:50:56Z")

</div>

If you are looking for help in this forum it help to describe the issue and setup you have in detail. The more effort you put into explaining your use case and issue, the better the chance to receive a good and relevant answer.

Whenever I personally see a short post like your wiothout any context I tend to avoid it as it usually end up in a protracted back and forth to extract the relevant information and define the exact issue, which requires a lot of effort.

---

<div class="post-metadata">

**Author:** ![jt2023](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jt2023/32/123449_2.png) [@jt2023](https://discuss.elastic.co/u/jt2023)\
**Post date:** [May 10, 2025, 12:16pm UTC](https://discuss.elastic.co/t/ntp-server-time-sync-issue-how-to-write-alerts-query-dsl/378006/3 "2025-05-10T12:16:05Z")

</div>

I would like to know how to check time sync issue in NTP SERVER via monitoring in ELK

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 10, 2025, 3:14pm UTC](https://discuss.elastic.co/t/ntp-server-time-sync-issue-how-to-write-alerts-query-dsl/378006/4 "2025-05-10T15:14:12Z")

</div>

Closing as duplicate of:

> [@\[Urgent\] which 2 fields in Elastic Search can be made as time unsync comparsion?](https://discuss.elastic.co/t/urgent-which-2-fields-in-elastic-search-can-be-made-as-time-unsync-comparsion/378007):
>
> { "query": { "query\_string": { "query": "("NTP server status changes to unreachable" OR "Global time setting changed by NTP") AND devname:(ABC)", "default\_field": "logdesc" } } }

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 10, 2025, 3:14pm UTC](https://discuss.elastic.co/t/ntp-server-time-sync-issue-how-to-write-alerts-query-dsl/378006/5 "2025-05-10T15:14:18Z")

</div>