# Tracking Containment Alerts **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [December 14, 2021, 9:42pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872 "2021-12-14T21:42:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![lmoore2210](https://avatars.discourse-cdn.com/v4/letter/l/f0a364/32.png) [@lmoore2210](https://discuss.elastic.co/u/lmoore2210)\ **Post date:** [December 14, 2021, 9:42pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872/1 "2021-12-14T21:42:26Z")
Hey Elastic Crew, Right now I'm using a NiFi flow to push static GEOJSON data using now() timestamps to an Elasticsearch. The following file is an example: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/c/ecea546bba36867c9ae0f61f872e7adcd788a971.png) I've set up an alert that "should" trigger when my GEOJSON points move outside the boundary of the state of California, which I imported as GEOJSON. ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/8380b8e52703a7534acaaa3d0859f05668c14749.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a3a691572db6b0ae08579b79a0278f6809461ca2.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f6ab7fb44f7f24819c5b08e5736ae962926a69c1.png) As you can see when I post the indices on the map, I am showing outside the bounds, but yet my alert is not firing. ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/08d1e9f8e33f8ac24b3d2b4c85ada54aa493cbf8.png) Curious if there's anyone with experience that can help me out. v/r Luke M. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 16, 2021, 7:33pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872/2 "2021-12-16T19:33:49Z")
What does the top of the alert look like the Interval and Alert on.. Is it possible that the outside point are older than the alert looks back? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 16, 2021, 8:49pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872/3 "2021-12-16T20:49:23Z")
One other thought on this... the entities need to enter or exit or appear if they are just static I do not think it will fire... I tested this seemed to be the behavior! ---
**Author:** ![lmoore2210](https://avatars.discourse-cdn.com/v4/letter/l/f0a364/32.png) [@lmoore2210](https://discuss.elastic.co/u/lmoore2210)\ **Post date:** [December 17, 2021, 7:37pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872/4 "2021-12-17T19:37:44Z")
It looks like I got it to work - somewhat. I'm still playing with it, but after setting it to check every 1 second and notify every hour, I was able to get some pings with the webhook to my Teams. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 17, 2021, 8:03pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872/5 "2021-12-17T20:03:26Z")
Timestamp / Temporal is definitely a component of the alert.... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 14, 2022, 8:03pm UTC](https://discuss.elastic.co/t/tracking-containment-alerts/291872/6 "2022-01-14T20:03:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.