# Server Down or Restarted Alert Rule

**URL:** https://discuss.elastic.co/t/server-down-or-restarted-alert-rule/381938
**Category:** Elastic Observability
**Tags:** elastic-stack-monitoring, elastic-stack-alerting
**Created:** [September 15, 2025, 7:00am UTC](https://discuss.elastic.co/t/server-down-or-restarted-alert-rule/381938 "2025-09-15T07:00:28Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![lomar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lomar/32/145141_2.png) [@lomar](https://discuss.elastic.co/u/lomar)
#### Post date: [September 15, 2025, 7:00am UTC](https://discuss.elastic.co/t/server-down-or-restarted-alert-rule/381938/1 "2025-09-15T07:00:29Z")

</div>

I want to monitor whether my servers are shut down or restarted. To do this, I created a Metricbeat Threshold rule via Observability, but it is not working properly. Even if the condition that triggered the alarm is no longer present, the alarm does not stop.

 ![rule](https://us1.discourse-cdn.com/elastic/original/3X/5/2/529a769cca001858bd421f2c51d735b3c12f3503.png)

In most alarms, the Observed value field appears as [NO DATA].

---

<div class="post-metadata">

### Author: ![lomar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lomar/32/145141_2.png) [@lomar](https://discuss.elastic.co/u/lomar)
#### Post date: [September 15, 2025, 7:41am UTC](https://discuss.elastic.co/t/server-down-or-restarted-alert-rule/381938/2 "2025-09-15T07:41:05Z")

</div>

Metricbeat sends data at every 10 minutes, however the rule checks for data every 2 minutes for the last 3 minutes, so It gives [NO DATA]. I've increased the rule schedule and loopback time. Are ther any ways to close alerts from the old rule configuration or I must untrack all of them?