# Rules don't create alert when value 0 or index not exist

**URL:** <https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [January 13, 2022, 9:20am UTC](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251 "2022-01-13T09:20:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zakabluk](https://avatars.discourse-cdn.com/v4/letter/z/8baadc/32.png) [@zakabluk](https://discuss.elastic.co/u/zakabluk)\
**Post date:** [January 13, 2022, 9:20am UTC](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251/1 "2022-01-13T09:20:10Z")

</div>

Kibana v 7.13.3

Hi! I created Rule with "Index threshold". I set

## INDEX (I chose index pattern for datastream and "Time field") WHEN count() OVER all documents IS BELOW 10000 FOR THE LAST 10 minutes

Problem: When events enter the index rule works is fine. When docs less then my value in "IS BELOW 10000" a get allert.  
BUT if index(datastream) is absent or docs isn't enter to index mode then value "FOR THE LAST " I see on the "Alert Visualisation" that "count()" is zero it's less when trashhold. But alert doesn't work. I tried set instead BELOW to BETWEEN and use value from 0 to 1 but it doesn't help me.

---

<div class="post-metadata">

**Author:** ![gmmorris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gmmorris/32/72624_2.png) [@gmmorris](https://discuss.elastic.co/u/gmmorris)\
**Post date:** [January 13, 2022, 9:41am UTC](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251/2 "2022-01-13T09:41:46Z")

</div>

Hi Andrei 👋

I believe you've encountered a bug that was fixed in 7.14.1 and 7.15.0: [[Alerting] Allow rule to execute if the value is 0 and that mets the condition by chrisronline · Pull Request #105626 · elastic/kibana · GitHub](https://github.com/elastic/kibana/pull/105626)

I'd recommend upgrading to the latest version if you can.

If you're curious about why this is happening - aggregations don't return values when there is _no data_, and we mistakenly missed an edge case where this wasn't handled correctly.  
This should now be addressed fully. 🙂

---

<div class="post-metadata">

**Author:** ![zakabluk](https://avatars.discourse-cdn.com/v4/letter/z/8baadc/32.png) [@zakabluk](https://discuss.elastic.co/u/zakabluk)\
**Post date:** [January 13, 2022, 9:44am UTC](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251/3 "2022-01-13T09:44:11Z")

</div>

Very Very big ThanX.

---

<div class="post-metadata">

**Author:** ![gmmorris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gmmorris/32/72624_2.png) [@gmmorris](https://discuss.elastic.co/u/gmmorris)\
**Post date:** [January 13, 2022, 1:02pm UTC](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251/4 "2022-01-13T13:02:58Z")

</div>

Any time :elasticheart:

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 10, 2022, 1:03pm UTC](https://discuss.elastic.co/t/rules-dont-create-alert-when-value-0-or-index-not-exist/294251/5 "2022-02-10T13:03:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.