# System Down alert on Kibana

**URL:** <https://discuss.elastic.co/t/system-down-alert-on-kibana/282860>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [August 30, 2021, 11:46pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860 "2021-08-30T23:46:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![grumpypant](https://avatars.discourse-cdn.com/v4/letter/g/f0a364/32.png) [@grumpypant](https://discuss.elastic.co/u/grumpypant)\
**Post date:** [August 30, 2021, 11:46pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860/1 "2021-08-30T23:46:51Z")

</div>

New to ELK  
I'm trying to setup rules for alerting on Kibana. One of them would be "Host Down".  
Trying to use the system.uptime.duration.ms metricset to tell me if a Host is down for more than 5 mins.  
So far, below image is what I get. I turned off one the hosts and so I should be getting "1 instance has satisfied the condition" instead I'm getting 0. I know I'm missing something rudimentary here, Please help.

 ![Screenshot (49)_LI](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5cf68fbe882b65195d3007fe6575c81c6af86bf0.jpeg)

Also is there a link where we can view examples for alerting?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 31, 2021, 3:27am UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860/2 "2021-08-31T03:27:38Z")

</div>

Welcome to our community! 😃

You are only alerting on the last 1 min, as per the timeframe right under the bar graph. Can you change that and see if it helps?

---

<div class="post-metadata">

**Author:** ![grumpypant](https://avatars.discourse-cdn.com/v4/letter/g/f0a364/32.png) [@grumpypant](https://discuss.elastic.co/u/grumpypant)\
**Post date:** [August 31, 2021, 8:00pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860/3 "2021-08-31T20:00:07Z")

</div>

Thank you! Glad to be here!

 ![Screenshot (51)_LI](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba96dea2980e07be6b0a11d7bb05054493149cfc.jpeg)

That worked! Any reason why it wouldn't work for 1 min?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 31, 2021, 9:57pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860/4 "2021-08-31T21:57:30Z")

</div>

Because if you may not have any matching "down" events in that last minute.

---

<div class="post-metadata">

**Author:** ![grumpypant](https://avatars.discourse-cdn.com/v4/letter/g/f0a364/32.png) [@grumpypant](https://discuss.elastic.co/u/grumpypant)\
**Post date:** [September 1, 2021, 4:41pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860/5 "2021-09-01T16:41:41Z")

</div>

alerting for 1 min has worked too.

 ![Screenshot (54)_LI](https://us1.discourse-cdn.com/elastic/original/3X/0/6/067be1ec048c77e8bf61f2f90494be9293f1920c.jpeg)

The status on the rule changes to recovered after 15 mins or so, enough though I haven't restarted the server or metricbeat. Am I missing something? I need to make this alert ongoing until resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2021, 4:42pm UTC](https://discuss.elastic.co/t/system-down-alert-on-kibana/282860/6 "2021-09-29T16:42:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.