Simple things should be simple was one of the themes at Elastic{ON} ‘17, our annual user conference where we connect with our users. During and prior to the user conference, we received many requests for a simple and easy to use UI to create alerts. As it turns out, creating a single UI to work effectively for all types of alerts is pretty hard. For example, a UI that can create an alert when the average CPU utilization goes over 50% looked pretty different from a UI that can create an alert when there are many concurrent logins from the same IP address.

Since it is hard to build a universal UI for all types of alerts, we decided to tackle the UI for the most commonly requested alert first: a simple, threshold alert that is triggered when a metric goes above or below a given threshold.

Before we can get into examples, make sure that you have the minimum of version of 6.0.0-beta 2 of Elasticsearch and Kibana installed with X-Pack installed on both. Also, ensure that you have Elasticsearch configured with a user with sufficient rights. Now, we need some interesting data with which to build our alerts. Metricbeat is a great beat for monitoring system and user processes on a machine. To set up Metricbeat, refer to our documentation here.

Once Metricbeat is installed and running, open up a browser and navigate to Kibana. Click on the Management app in the side navigation bar, and then click on Watcher under the Elasticsearch heading.

Now, click on the ‘Create New Watch’ button and select ‘Threshold Alert’. This will bring you to the new threshold alert UI.

In the ‘Create a new threshold alert’ panel, configure the name, index, time field and the trigger interval. This will reveal the condition panel with a simple condition already populated, as well as a visualization of the data that the condition is based upon.

For our first example, we want a threshold alert that is triggered when the maximum of the total CPU usage on a machine ever goes above 50% during the past 5 minutes. This is a very common type of alerts because it can help understand when and where the spikes are happening to take an action. We will choose 50% as a threshold value. Modify the condition expression so that it matches the image below. As you change the expression, the visualization is updated automatically to show the threshold value and data as red and blue lines respectively.

Now that we have configured the condition to trigger the alert, let’s configure what we want to happen when that condition is met. In this case, we want to send an E-mail to the person to which it matters most. Click on the ‘Add new action’ select box, and choose ‘E-mail’. A sample configuration for an e-mail action is shown below.

Note that you can use mustache syntax to access the {{ctx}} object which contains information about the alert when it triggers. We are using that here to embed the max CPU value into the body of our e-mail. If you have an e-mail account configured in Elasticsearch, then you can click on the ‘Test fire an e-mail now’ and watcher will send out a sample e-mail.

Click on the ‘Save’ button to save your new alert. There is now a threshold alert running on your Elasticsearch cluster.

Want to see this feature in a live demo?

But of course there’s more, like what’s coming up next. We have plans to allow you to use Kibana's saved searches to be the input for a threshold alert since those are fairly common and currently used in other areas of Kibana. We also plan to build out more UIs for other alerting use cases, such as comparing today’s value with last week’s value and alerting when the change goes beyond a certain threshold.

Go use this feature and check out our documentation for more details. As you dive into the 6.0 preview releases, we'd love to hear your feedback as part of our Pioneer Program. Your insights make our software better!

上下文工程

向量数据库

Search AI 驱动的应用程序

日志

威胁防护

工作流

Elasticsearch

Kibana（Discover、仪表板）

Elastic 智能体生成器

自动操作

管道化查询语言

Jina AI 搜索模型

Elastic Cloud Serverless

Elastic Cloud 托管

自管型 Elasticsearch

电子商务搜索

客户服务搜索

搜索驱动型应用程序

日志分析

基础架构监测

数字体验监测

应用性能监控

AIOps

LLM 可观测性

新一代 SIEM

安全工作流

XDR 和终端安全

面向安全的 AI

实现数据价值十倍跃升

云服务提供商

Elastic AI 生态系统

Search AI 合作伙伴计划

AV-Comparatives

Forrester Wave™ 领导者

Gartner 魔力象限领导者

IDC MarketScape 领导者

Search

安全性

可观测性

开始使用

演示库

下载

集成

文档

Elasticsearch Labs

Elastic 安全实验室

Elastic 可观测性实验室

博客

社区

活动

网络研讨会

讨论

培训

支持

咨询

Author

Articles by Chris Roberson

Principal Software Engineer, Elastic

Creating a threshold alert in Elasticsearch is simpler than ever.

Sign up for Elastic Cloud free trial