Optimize Action in Alerts to trigger only once for a detected anomaly

Elastic Stack Elasticsearch
2

You can set a throttle_period long enough to ensure that the anomalies are resolved.

If the current anomaly (i.e. what makes the condition come true) is resolved within the throttle period:

  • the next watch execution won't have it's condition met so...
  • no actions will be executed and
  • the alert will be "rearmed", ready for the next anomaly.

A similar question has been asked here recently, you can get more information there: How to stop sending duplicate Slack notifications for the same error?