# Threshold Alert on days until expiry

**URL:** <https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [December 11, 2018, 9:21am UTC](https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329 "2018-12-11T09:21:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mark.lawton2](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@mark.lawton2](https://discuss.elastic.co/u/mark.lawton2)\
**Post date:** [December 11, 2018, 9:21am UTC](https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329/1 "2018-12-11T09:21:41Z")

</div>

Hello, fairly new to Elastic Stack and having a play with the Watcher to try and get some useful threshold alerts.

One I'm struggling on is this scenario:  
We have heartbeat which is monitoring various https websites, one of the metrics pulled back is "tls.certificate\_not\_valid\_after" e.g. tls.certificate\_not\_valid\_after = "August 12th 2021, 09:40:34.000".

I want to create a new threshold alert (or advanced watcher?) so that if there is less than 30 days until the tls.certificate\_not\_valid\_after date then it triggers the alert.

I can't see any way of creating an alert based on date? Or am I going about this completely the wrong way?

---

<div class="post-metadata">

**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\
**Post date:** [December 11, 2018, 10:27pm UTC](https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329/2 "2018-12-11T22:27:09Z")

</div>

Hi, you will need to create an Advanced Watch for this. Documentation:  
[https://www.elastic.co/guide/en/elastic-stack-overview/current/watcher-getting-started.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/watcher-getting-started.html)

One way is to use a [range query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates) search input to retrieve documents where `tls.certificate_not_valid_after` is less than now plus 30 days. Then a [compare condition](https://www.elastic.co/guide/en/elastic-stack-overview/current/condition-compare.html) can be used to check the number of documents returned \> 0 and send an alert.

---

<div class="post-metadata">

**Author:** ![mark.lawton2](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@mark.lawton2](https://discuss.elastic.co/u/mark.lawton2)\
**Post date:** [December 13, 2018, 10:53am UTC](https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329/3 "2018-12-13T10:53:34Z")

</div>

Hi Jen, thank you so much for pointing me in the right direction. I now have successful results returning from my search with:

{  
"trigger": {  
"schedule": {  
"interval": "1h"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": ["heartbeat\*"],  
"types": ,  
"body": {  
"query": {  
"range": {  
"tls.certificate\_not\_valid\_after": {  
"lt": "now+30d"  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},  
"actions": {  
"send\_email": {  
"email": {  
"profile": "standard",  
"to": [  
"xx@xx.com"  
],  
"subject": "Certificate Expiry Warning",  
"body": {  
"text": "{{ctx.payload.hits.total}} certificate warnings"  
}  
}  
}  
}  
}

This obviously brings back a huge count as it counts each document that's less than 30 days until the date. How would I take this further by using a field within heartbeat indice such as "http.url" and only return a positive count for each unique "http.url"?

To summarise what I'm trying to achieve:  
Use the heartbeat indice and trigger an email with details of any "http.url"'s where the tls.certificate\_not\_valid\_after date is less than 30 days.  
Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2019, 10:53am UTC](https://discuss.elastic.co/t/threshold-alert-on-days-until-expiry/160329/4 "2019-01-10T10:53:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.