# Watcher to check if the VM is down **URL:** \ **Category:** Metrics\ **Tags:** elastic-stack-alerting\ **Created:** [September 5, 2020, 4:57pm UTC](https://discuss.elastic.co/t/watcher-to-check-if-the-vm-is-down/247642 "2020-09-05T16:57:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vamsikrishna\_medeti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vamsikrishna_medeti/32/59108_2.png) [@vamsikrishna\_medeti](https://discuss.elastic.co/u/vamsikrishna_medeti)\ **Post date:** [September 5, 2020, 4:57pm UTC](https://discuss.elastic.co/t/watcher-to-check-if-the-vm-is-down/247642/1 "2020-09-05T16:57:50Z")
Hi, We are using metricbeat/ELK for monitoring our kubernetes (EKS) cluster. I would like to create an alert if the node is down. May I know how to do it? Because when the VM is down, the metricbeat daemonset can not send the data and how can I create alert that the node is down. @Ayush_Agrahari ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 5, 2020, 10:07pm UTC](https://discuss.elastic.co/t/watcher-to-check-if-the-vm-is-down/247642/2 "2020-09-05T22:07:42Z")
What version of ELK are you using? There's a couple different philosophies on this. 1. Alert when the telemetry (metricbeat doc count = 0 for some time interval group by host) is stopped sending. This tells you that metricbeat is not shipping telemetry but does is not _necessarily_ mean the VM is down, perhaps a good indicator but not necessarily. 2. Another way to do this is use heartbeat and up time to ping to be VM externally to see if it is up and on the network. 2 related but slightly different approaches. I asked about the version because the newer versions with the kibana alerting have an easy way alert when the telemetry stops ---
**Author:** ![vamsikrishna\_medeti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vamsikrishna_medeti/32/59108_2.png) [@vamsikrishna\_medeti](https://discuss.elastic.co/u/vamsikrishna_medeti)\ **Post date:** [September 6, 2020, 2:16am UTC](https://discuss.elastic.co/t/watcher-to-check-if-the-vm-is-down/247642/3 "2020-09-06T02:16:59Z")
Thanks @stephenb. I am using 7.9.0. Ping and ssh are disabled on the servers. So may be I need to go with approach-1. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 6, 2020, 3:03am UTC](https://discuss.elastic.co/t/watcher-to-check-if-the-vm-is-down/247642/4 "2020-09-06T03:03:59Z")
Yup understand there is also ICMP for heartbeat, but understand So method 1 you can do in watcher OR if you looks at the new Kibana alerting framework you just select an option to get alerted when there is no data This is a Metric Threshold ![Screen Shot 2020-09-05 at 8.03.10 PM](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c27c80ce77380af730cd6549c60b85d9a2cc8b7.png) ---
**Author:** ![vamsikrishna\_medeti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vamsikrishna_medeti/32/59108_2.png) [@vamsikrishna\_medeti](https://discuss.elastic.co/u/vamsikrishna_medeti)\ **Post date:** [September 6, 2020, 4:24am UTC](https://discuss.elastic.co/t/watcher-to-check-if-the-vm-is-down/247642/5 "2020-09-06T04:24:17Z")
Thanks @stephenb. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2020, 4:24am UTC](https://discuss.elastic.co/t/watcher-to-check-if-the-vm-is-down/247642/6 "2020-10-04T04:24:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.