# Only create an alert when the query gets three hits from the same device

**URL:** <https://discuss.elastic.co/t/only-create-an-alert-when-the-query-gets-three-hits-from-the-same-device/209711>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [November 27, 2019, 2:59pm UTC](https://discuss.elastic.co/t/only-create-an-alert-when-the-query-gets-three-hits-from-the-same-device/209711 "2019-11-27T14:59:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [November 27, 2019, 2:59pm UTC](https://discuss.elastic.co/t/only-create-an-alert-when-the-query-gets-three-hits-from-the-same-device/209711/1 "2019-11-27T14:59:07Z")

</div>

Hi,

We want to create an alert when there has been over three failed logon events. Our query looks like this:

```
POST /logstash-test-2019-11/_search
{
  "query": {
        "bool": {
          "must": [
            {
              "query_string": {
                "query": "message: \"authentication failure\" AND \"sshd\""
              }
            }
          ],
          "filter": {
            "range": {
              "@timestamp": {
                "gte": "now-30m"
              }
            }
          }
        }
      }
}

```

And our whole watch:

```
{
  "trigger": {
    "schedule": {
      "interval": "10m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logstash-test-*"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "message: \"authentication failure\" AND \"sshd\""
                  }
                }
              ],
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-30m"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 3
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "user@example.com"
        ],
        "subject": "test-subject",
        "body": {
          "text": "test-text"
        }
      }
    }
  }
}

```

This successfully alerts whenever we get three hits of the query in last 30 minutes. However, it also creates an alert if there are three separate failed logons for separate devices. We want to make it so that it should only alert if there are at least three hits of the same device. We save the FQDN of each device in a field called FQDN, so could we somehow use that?

Thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 28, 2019, 9:08am UTC](https://discuss.elastic.co/t/only-create-an-alert-when-the-query-gets-three-hits-from-the-same-device/209711/2 "2019-11-28T09:08:19Z")

</div>

The query needs to be refined before being able to write a proper watch. What is missing is a `terms` aggregation on the device. With this you will get an aggregation response, that contains the number of failed logins per device. You can also use the `min_doc_count` parameter to make sure only buckets with three login failures are returned. On top of that you will also need to change the condition. You might want to use a `script` condition that checks the size of the aggregation buckets being returned greater than 0 instead of the total hits (as those can be spread across devices).

Hope this helps!

---

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [November 29, 2019, 10:25am UTC](https://discuss.elastic.co/t/only-create-an-alert-when-the-query-gets-three-hits-from-the-same-device/209711/3 "2019-11-29T10:25:28Z")

</div>

Hi,

Thank you. We're almost there but need some help on the condition part.

We have the following query now:

```
POST /logstash-test-2019-11/_search
{
  "query": {
        "bool": {
          "must": [
            {
              "query_string": {
                "query": "message: \"authentication failure\" AND \"sshd\""
              }
            }
          ],
          "filter": {
            "range": {
              "@timestamp": {
                "gte": "now-3h"
              }
            }
          }
        }
      },
      "aggs": {
        "device": {
          "terms": {
            "field": "device.keyword",
            "min_doc_count": 3
          }
        }
      }
}

```

Which returns the following (some output omitted):

```
"aggregations" : {
    "device" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "smtpout01,
          "doc_count" : 3
        },
        {
          "key" : "smtp01",
          "doc_count" : 3
        }
      ]
    }
  }

```

How would i use something like bucket.key and bucket.doc\_count? I want the condition to turn true if 1 or more device aggregation returns more than or equal to 3 hits.

Thank you!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [December 2, 2019, 9:17am UTC](https://discuss.elastic.co/t/only-create-an-alert-when-the-query-gets-three-hits-from-the-same-device/209711/4 "2019-12-02T09:17:58Z")

</div>

try checking for `ctx.payload.aggregations.device.buckets.size() > 0` in a script condition

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2019, 9:17am UTC](https://discuss.elastic.co/t/only-create-an-alert-when-the-query-gets-three-hits-from-the-same-device/209711/5 "2019-12-30T09:17:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.