# Unable to get logs to elastalert with helk

**URL:** <https://discuss.elastic.co/t/unable-to-get-logs-to-elastalert-with-helk/339926>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 2, 2023, 10:30am UTC](https://discuss.elastic.co/t/unable-to-get-logs-to-elastalert-with-helk/339926 "2023-08-02T10:30:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![deloittepocra](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@deloittepocra](https://discuss.elastic.co/u/deloittepocra)\
**Post date:** [August 2, 2023, 10:30am UTC](https://discuss.elastic.co/t/unable-to-get-logs-to-elastalert-with-helk/339926/1 "2023-08-02T10:30:45Z")

</div>

Hi Team,  
I have successfully set up helk by following the instructions provided in the GitHub repository. Additionally, I have configured winlogbeat to send my event/sysmon logs to Kibana through Kafka. Now, my goal is to configure elastAlert to receive notifications for specific event IDs from winlogbeat and integrate it with Slack. I have followed a guide to achieve this, but despite the configuration, I am not seeing any logs for elastalert in Kibana. I would like assistance in troubleshooting and resolving this issue so that I can receive elastalert notifications for specific event IDs in my helk setup.

This is the error screenshot that for the index elastalert\_status\_status from kibana

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87180ff3ab96069b880cda0c2254e696f1770a65.png)

This is my elastalert configuration to integrate with slack

```auto
  helk-elastalert:
    image: otrf/helk-elastalert:latest
    container_name: helk-elastalert
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "6m"
    restart: always
    depends_on:
      - helk-logstash
    environment:
      ES_HOST: helk-elasticsearch
      ES_PORT: 9200
      SLACK_WEBHOOK_URL: https://hooks.slack.com/services/<random-string>
    networks:
      helk:

```

Thanks in advance

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 2, 2023, 1:16pm UTC](https://discuss.elastic.co/t/unable-to-get-logs-to-elastalert-with-helk/339926/2 "2023-08-02T13:16:59Z")

</div>

Hello and welcome,

ElastAlert is a third-party tool that it is not supported here, it would be better to open an issue on the repository you used to spin-up the stack to understand what didn't work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2023, 1:17pm UTC](https://discuss.elastic.co/t/unable-to-get-logs-to-elastalert-with-helk/339926/3 "2023-08-30T13:17:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.