# Uptime Monitor Status Rule / Alert , Which field is considered to filter?
**URL:** https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200
**Category:** Synthetics
**Created:** [September 12, 2022, 2:24pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200 "2022-09-12T14:24:35Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)
#### Post date: [September 12, 2022, 2:24pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200/1 "2022-09-12T14:24:35Z")
Hello Experts,
I have configured Heartbeat. To reduce the data , I have used "include fields" processor as below. So, now I get data for below fields and metadata fields (default).
the issue is , in "Uptime Monitor Status" rule , I tried adding filter with Monitor name , it shows 0 monitors, But data is flowing.
I guess, this rule uses some other field ( other than fields mentioned in include\_fields) to filter.
I tried default configuration i.e without "include\_fields" processor. This time above filter worked
I want to know which field is used to filter monitors in Uptime Monitor Status rule
---
### Author:  [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [September 12, 2022, 4:03pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200/2 "2022-09-12T16:03:12Z")
We don't recommend removing any fields sent by uptime, but rather using ILM to rotate data more efficiently. We can't guarantee that Uptime will work correctly if fields are dropped.
---
### Author:  [@aji.shinde7](https://discuss.elastic.co/u/aji.shinde7)
#### Post date: [September 27, 2022, 2:16pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200/3 "2022-09-27T14:16:27Z")
Hello Andrew,
Thank you for your reply.
After trial and error I found few important fields, those are enough to set an alert. I have tested this and found that Alerts are working as expected.
I will go with this setting for now. This is helping to avoid Shards error (by reducing data)
processors:
- include\_fields:
fields: ["monitor.status", "monitor.name", "monitor.id", "tags", "ip","hosts", "summary.down", "summary.up", "state.up", "state.down","state.status", "state.checks", "beat.hostname","beat.name","monitor.name.text","monitor.id.text","[monitor.duration.us](http://monitor.duration.us)","monitor.scheme","monitor.check\_group","monitor.timespan", "[tls.rtt.handshake.us](http://tls.rtt.handshake.us)","tls.server.version\_number", "monitor.type"]
---
### Author:  [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [September 28, 2022, 10:56pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200/4 "2022-09-28T22:56:34Z")
I'm glad you found a solution, however I'll reiterate that we don't recommend dropping fields since that can easily break the Uptime app. If you have an excess of data, consider managing the [retention](https://www.elastic.co/guide/en/observability/current/synthetics-manage-retention.html) of that data instead, by [reading our docs](https://www.elastic.co/guide/en/observability/current/synthetics-manage-retention.html) on that topic.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2022, 10:57pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-rule-alert-which-field-is-considered-to-filter/314200/5 "2022-10-22T22:57:10Z")
This topic was automatically closed 24 days after the last reply. New replies are no longer allowed.