WARNING: Version 6.2 of Kibana has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Getting Started Create Advanced Watch »
Elastic Docs ›Kibana User Guide [6.2] ›Management ›Watcher UI

Create Threshold Alert

edit

Create Threshold Alert

edit

You can create a threshold alert to periodically check when your data goes above or below a certain threshold within a given time interval. It’s one of the most common type of alerts that you can create using Watcher. For more advanced watches, see the Create Advanced Watch.

To create a new threshold alert:

  1. Select the Create new watch button Create a Watch
  2. Select Threshold Alert

Next, let’s look at the UI and how to use it.

Inputs & Triggers

edit

To create a threshold alert, you need to first configure the inputs and triggers.

  1. Add a name for the alert.
  2. Choose one or more indices that have a time-based field as the alert input.
  3. Configure a trigger interval.

Created Threshold Alert

Next, you will be able to specify the conditions to trigger the alert.

Condition

edit

Here, you can configure the condition that will cause alert to trigger. The UI is interactive and selecting the various elements within the expression will display a UI to change the values.

Threshold Alert Agg Type

Let’s look at a few examples of common alerts based on x-pack monitoring data:

  • High heap usage: Threshold Alert Example High Heap Usage
  • System load: Threshold Alert Example System Load

Here are some specifics of how the visualization works:

  • The time window that is used in the visualization is calculated by taking the duration defined in the expression and multiplying it by 5. So, if you select FOR THE LAST 5 hours, the visualization will show data from the last 25 hours.
  • In the chart, you will see a blue line that represents the aggregated data. There is also a red line that represents the threshold value.

  • If you use the terms aggregation to aggregate over a specific field, there will be multiple visualizations available and pagination controls will appear as shown below.

    • Threshold Alert Group By pagination

Actions

edit

Here you can configure the various actions that will occur when the alert fires.

Click Add new action to trigger a dropdown selection:

Threshold Alert Select Action

Selecting an action will allow you to customize settings for the respective action.

Threshold Alert Logging Action

All fields for an alert support using mustache syntax and expose a {{ctx}} variable which exposes various properties of the alert

The supported actions are:

Note that certain actions require configuration within ES, such as email and slack.

« Getting Started Create Advanced Watch »