# Use Elastic for Kubernetes monitoring

**URL:** <https://discuss.elastic.co/t/use-elastic-for-kubernetes-monitoring/318353>\
**Category:** Elastic Observability\
**Created:** [November 7, 2022, 4:47pm UTC](https://discuss.elastic.co/t/use-elastic-for-kubernetes-monitoring/318353 "2022-11-07T16:47:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![EDzhelyov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edzhelyov/32/113054_2.png) [@EDzhelyov](https://discuss.elastic.co/u/EDzhelyov)\
**Post date:** [November 7, 2022, 4:47pm UTC](https://discuss.elastic.co/t/use-elastic-for-kubernetes-monitoring/318353/1 "2022-11-07T16:47:04Z")

</div>

We are trying to replace our Prometheus metrics and alarms with the Elastic stack and run into some issues.

For example, with Prometheus, we use the `up` metric to create an alarm that will tell us if a given service, like `etcd`, is down. But what will be the equivalent alarm in Elastic?

At the moment we use this condition: `WHEN Document count IS ABOVE OR EQUALS 1` and filters not `running` pods: `not kubernetes.pod.status.phase:running and kubernetes.labels.app:etcd`

What is considered as best practice for such alarms in Elastic?

---

<div class="post-metadata">

**Author:** ![faisal-k](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faisal-k/32/103817_2.png) [@faisal-k](https://discuss.elastic.co/u/faisal-k)\
**Post date:** [November 8, 2022, 12:35pm UTC](https://discuss.elastic.co/t/use-elastic-for-kubernetes-monitoring/318353/2 "2022-11-08T12:35:57Z")

</div>

Hello @EDzhelyov,  
Thanks for reaching out, and welcome to the Elastic community!

The conditions and the filter you shared seem reasonable and should fulfill the purpose.

As you know, the pod **status** could be `Pending,` `Succeeded,` `Unknown,` or `Failed` and based on the filter you shared, these statuses will also trigger the alert. So it depends on your desire and how sensitive the rule is; you could be more granular on the pod status. e.g. distinct the list of the healthy status.

Have a great day!  
Faisal
