# Unable to create Threshold rule

**URL:** <https://discuss.elastic.co/t/unable-to-create-threshold-rule/316262>\
**Category:** Elastic Security\
**Created:** [October 11, 2022, 3:28am UTC](https://discuss.elastic.co/t/unable-to-create-threshold-rule/316262 "2022-10-11T03:28:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [October 11, 2022, 3:28am UTC](https://discuss.elastic.co/t/unable-to-create-threshold-rule/316262/1 "2022-10-11T03:28:45Z")

</div>

Hi Team,

I am trying to write a threshold rule but failing to find the exact results. Can someone please help? I have nginx logs pouring in and wanted to setup the threshold alert so that if source.ip \>=750 from single IP it should send me the notification. I put that in a rule but still unable to match the exact result. Here is the snip

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/c/2c26ed967f42926560ece8ef8d26af8fd5f14a81.png)

I am not able to capture the value and please help me with this?

TIA  
Blason R

---

<div class="post-metadata">

**Author:** ![Marshall\_Main](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marshall_main/32/77883_2.png) [@Marshall\_Main](https://discuss.elastic.co/u/Marshall_Main)\
**Post date:** [October 19, 2022, 10:35pm UTC](https://discuss.elastic.co/t/unable-to-create-threshold-rule/316262/2 "2022-10-19T22:35:12Z")

</div>

Hi @Blason ,

What stack version are you on?

One problem that stands out in the snip is that both "Group by" and "Count" are looking at `source.ip`. Since "Count" is counting up the different `source.ip` values in each bucket _after_ the buckets are created by grouping together documents with the same `source.ip` values, the result of "Count" will almost always be 1. We added validation in recent versions to disallow using the same field for both "Group by" and "Count".

An example use case for "Count" would be something like "Group by" `host.name` and "Count" by `user.name` \>= 5, if you were interested in looking for hosts where 5 or more users have accessed that host.

However, since the minimum "Count" is set to 1 in the screenshot, this should still work. I would suggest also checking to ensure that the rule interval and additional lookback are set long enough that at least 700 documents with a single `source.ip` value are in a single rule interval. For example, with a rule interval of 5 minutes and additional lookback of 1 minute, you would need to have 700 documents with a particular `source.ip` value in the last 6 minutes for the rule to trigger an alert.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2022, 10:36pm UTC](https://discuss.elastic.co/t/unable-to-create-threshold-rule/316262/3 "2022-11-16T22:36:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.