# Uptime Alerts just not works **URL:** \ **Category:** Synthetics\ **Tags:** elastic-stack-alerting\ **Created:** [August 16, 2020, 12:30pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139 "2020-08-16T12:30:29Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![alex-rn](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@alex-rn](https://discuss.elastic.co/u/alex-rn)\ **Post date:** [August 16, 2020, 12:30pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/1 "2020-08-16T12:30:29Z")
Hello, I have successfully configured Heartbeat with Uptime and everything works well. But I have a very strange issues with Kibana Alerts. See screenshots. 1. In Uptime Alerts I can see and use only the "MATCHING MONITORS ARE DOWN" condition, no more. I see another filters, I mean I can use only this condition. For example no condition like "ALL MONITORS ARE DOWN". 2. In Uptime I have no DOWN monitors for more than last 15 minutes, but Alert event is always active. ![uptime-overview](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1e368e54e5e6c0e1d422b2ae65fb3d3591ebf687.png) ![alert-details](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fefc1ce03a16a8ebb83784e01db42d2aeb1ce102.png) ![alert-events](https://us1.discourse-cdn.com/elastic/original/3X/2/8/289ad4d01804c27b4c6234ed31d1c9fc03466502.png) What I'm doing wrong? I just do not understand the situation. I tried a lot of tricks and settings, but no luck. Anyone have an idea? I am using a simple KQL: > monitor.id:("monitor-1" or "monitor-2" or "monitor-3" or "monitor-4") I'm running the latest Elastic Cloud 7.8.1 ---
**Author:** ![shahzad31](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shahzad31/32/51637_2.png) [@shahzad31](https://discuss.elastic.co/u/shahzad31)\ **Post date:** [August 19, 2020, 3:53pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/2 "2020-08-19T15:53:39Z")
Hi @alex-rn, sorry we missed your post somehow. Alert is always active means, you are getting the alert message via email/slack etc? ---
**Author:** ![alex-rn](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@alex-rn](https://discuss.elastic.co/u/alex-rn)\ **Post date:** [August 19, 2020, 4:27pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/3 "2020-08-19T16:27:39Z")
Active is with status Active when go inside Alert and yes, actions applied. The issue seems with when I used more complex KQL. For example when I'm using the only one condition i.e. > tags:lxc it is works just fine. But when I apply more complex KQL i.e. > monitor.id:("monitor-1" or "monitor-2" or "monitor-3" or "monitor-4") alert status goes to Active like the monitored service is down. But both queries applies to the same monitoring items. I've just added a tag for avoid this issue. ---
**Author:** ![shahzad31](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shahzad31/32/51637_2.png) [@shahzad31](https://discuss.elastic.co/u/shahzad31)\ **Post date:** [August 19, 2020, 4:51pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/4 "2020-08-19T16:51:33Z")
So if no monitor is down during the selected period and you are still getting the alert message. To me it seems like a bug. We are continuously improving this. Will you mind opening an issue in [https://github.com/elastic/kibana/issues/new?template=Bug\_report.md](https://github.com/elastic/kibana/issues/new?template=Bug_report.md) we will be happy to take a look at it asap. Regards ---
**Author:** ![alex-rn](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@alex-rn](https://discuss.elastic.co/u/alex-rn)\ **Post date:** [August 19, 2020, 5:30pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/5 "2020-08-19T17:30:32Z")
Yes, this seems a bug. And one more thing - there is only one condition to select > MATCHING MONITORS ARE DOWN No more choices. Initially I just wanted to write about the bug on Github, but when I saw there a lot of things needed to be filled in form, I refused it. In addition, I am a Platinum client who is not a tester or developer or a beta software user. And in my opinion, such kind of customers can be protected from such time-consuming actions, since I simply do not have time for this. I wrote everything as I could here and I will be grateful if you inform your colleagues about this bug as expected. Thank you! ---
**Author:** ![shahzad31](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shahzad31/32/51637_2.png) [@shahzad31](https://discuss.elastic.co/u/shahzad31)\ **Post date:** [August 19, 2020, 5:40pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/6 "2020-08-19T17:40:35Z")
@alex-rn what other options would you like to have? You can choose any query or you can also add filters from tag/port/type/location etc In 7.9 we have also released availability checks. Purpose of this alert is you get an alert when your monitor is down. You can select any group of monitors by tweaking query or filters. Sure, we will take a look at the bug and see if we can reproduce this ourselves. Regards ---
**Author:** ![alex-rn](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@alex-rn](https://discuss.elastic.co/u/alex-rn)\ **Post date:** [August 19, 2020, 6:51pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/7 "2020-08-19T18:51:49Z")
Good description of the functionality already described on your Github. But please do not forget about STATUS, so I can send Resolved with actions. This is also not possible now. _The most basic alert we have talked about defining can be expressed in plain English as,_ ```auto WHEN "ANY" OR "ALL" MONITOR MATCHING [kql] IS [status] MORE THAN [numtimes] times WITHIN [timerange] FROM ANY [location option] ``` > > > Uptime Alert Type / UI Flyout > This issue tracks the implementation of the initial uptime alert type(s) and UI flyout. This will... Thank you! ---
**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\ **Post date:** [August 19, 2020, 7:42pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/8 "2020-08-19T19:42:09Z")
Can you please open an official support ticket as well? You mentioned that you're a platinum customer, which means you can go through our support organization instead of the forum. ---
**Author:** ![alex-rn](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@alex-rn](https://discuss.elastic.co/u/alex-rn)\ **Post date:** [August 19, 2020, 8:30pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/9 "2020-08-19T20:30:38Z")
I tried, but I'm unable to login [Support Portal](https://support.elastic.co/customers/s/login/) with my credentials that I'm using for login to [Elastic.co](http://Elastic.co). And the only way I found is this forum. ---
**Author:** ![alex-rn](https://avatars.discourse-cdn.com/v4/letter/a/85f322/32.png) [@alex-rn](https://discuss.elastic.co/u/alex-rn)\ **Post date:** [August 19, 2020, 8:36pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/10 "2020-08-19T20:36:48Z")
> [@alex-rn](#): > > I tried, but I'm unable to login [Support Portal](https://support.elastic.co/customers/s/login/) with my credentials that I'm using for login to [Elastic.co](http://Elastic.co). And the only way I found is this forum. I have sent a support email. Case #00597755 ---
**Author:** ![shahzad31](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shahzad31/32/51637_2.png) [@shahzad31](https://discuss.elastic.co/u/shahzad31)\ **Post date:** [August 21, 2020, 3:49pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/11 "2020-08-21T15:49:59Z")
@alex-rn we have PR up to resolve this issue. Apparently complex nested kuery are causing problems. This won't make it before 7.9.2 release. Since then you may have to rely on simple alert on everything by avoiding any nested filters. There is also a dirty workaround, you can append this to your kuery bar condition `and monitor.status : "down" and @timestamp >= "now-15m" and @timestamp <= "now"` basically this filter is being overridden so you have to add it to make it work. Keep in mind now-15m is value from flyout you selected like "Monitor is down \> 5 times within last 15mins " so if you have different condition, you have to change this, maybe for example if you select "WITHIN last 5 minutes". than this value will be "now-5m" For example it will look like this ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96cbe8da782cb8a34f595c6e9f4fc436f794e772.png) and also in flyout you may see the wrong value for "This alert will apply to approximately 0 monitors." since it has a condition monitor.status down and you may not have any down monitor in current state, so you can ignore that. Sorry for all the trouble. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2020, 3:50pm UTC](https://discuss.elastic.co/t/uptime-alerts-just-not-works/245139/12 "2020-09-18T15:50:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.