Create a threshold alert in Elasticsearch using a simple and easy Kibana UI.

<a href="https://www.elastic.co/elasticon/conf/2017/sf/opening-keynote">Simple things should be simple</a> was one of the themes at Elastic{ON} ‘17, our annual user conference where we connect with our users. During and prior to the user conference,&nbsp;we received many requests for a simple and easy to use UI to create alerts. As it turns out, creating a single UI to work effectively for all types of alerts is pretty hard. For example, a UI that can create an alert when the&nbsp;average CPU utilization goes over 50%&nbsp;looked&nbsp;pretty different from a UI that can create an&nbsp;alert when there are many concurrent logins from the same IP address.Since it is hard to build a universal UI for all types of alerts, we decided to tackle the UI for the most commonly requested alert first: a simple, threshold&nbsp;alert that is triggered&nbsp;when a metric goes above or below a given threshold. Before we can get into examples, make sure that you have the minimum of version of 6.0.0-beta 2 of <a href="https://www.elastic.co/downloads/elasticsearch#preview-release">Elasticsearch</a> and <a href="https://www.elastic.co/downloads/kibana#preview-release">Kibana</a> installed with <a href="https://www.elastic.co/downloads/x-pack#preview-release">X-Pack</a> installed on both. Also, ensure that you have Elasticsearch configured with a user with <a href="https://www.elastic.co/guide/en/kibana/6.0/watcher-security.html">sufficient rights</a>. Now, we need some interesting data with which to build our alerts. <a href="https://www.elastic.co/beats/metricbeat">Metricbeat</a> is a great beat for monitoring system and user processes on a machine. To set up Metricbeat, refer to our documentation <a href="https://www.elastic.co/guide/en/beats/metricbeat/6.0/metricbeat-installation.html">here</a>. Once Metricbeat is installed and running, open up a browser and navigate to Kibana. Click on the Management app in the side navigation bar, and then click on Watcher under the Elasticsearch heading. <img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltd79cd0b30bd5c1d6/5fa958d509ed4c6f277eb496/blog-threshold-alert-1.png" width="624" height="348" style="width: 624;height: 348;"/> Now, click on the ‘Create New Watch’ button and select ‘Threshold Alert’. This will bring you to the new threshold alert UI. In the ‘Create a new threshold alert’ panel, configure the name, index, time field and the trigger interval. This will reveal the condition panel with a simple condition already populated, as well as a visualization of the data that the condition is based upon. <img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt0d576f8480155b0a/5fa958dc6f82405d9a4aa796/blog-threshold-alert-2.png" width="624" height="163" style="width: 624;height: 163;"/> For our first example, we want a threshold alert that is triggered when the maximum of the total CPU usage on a machine ever goes above 50% during the past 5 minutes. This is a very common type of alerts because it can help understand when and where the spikes are happening to take an action. We will choose 50% as a threshold value. Modify the condition expression so that it matches the image below.&nbsp;As you change the expression, the visualization is updated automatically to show the threshold value and data as red and blue lines respectively. <img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt054cca82200a0818/5fa958dbffb61e50a0faab99/blog-threshold-alert-3.png" width="615" height="301" style="width: 615;height: 301;"/> Now that we have configured the condition to trigger the&nbsp;alert, let’s configure what we want to happen when that condition is met. In this case, we want to send an E-mail to the person to which it matters most. Click on the ‘Add new action’ select box, and choose ‘E-mail’. A sample configuration for an e-mail action is shown below. <img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blteb2d144ab6cb6a27/5fa958dc97f9f35d942e99c0/blog-threshold-alert-4.png" width="624" height="259" style="width: 624;height: 259;"/> Note that you can use <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/search-template.html#search-template">mustache</a> syntax to access the {{ctx}} object which contains information about the alert when it triggers. We are using that here to embed the max CPU value into the body of our e-mail. If you have an <a href="https://www.elastic.co/guide/en/x-pack/6.0/actions-email.html#configuring-email">e-mail account configured in Elasticsearch</a>, then you can click on the ‘Test fire an e-mail now’ and watcher will send out a sample e-mail.Click on the ‘Save’ button to save your new alert. There is now a threshold alert running on your Elasticsearch cluster.Want to see this feature in a live demo?<div class="video embed-container" style="height: 478px;margin-bottom: 15px;"><img style="width: 100%;margin: auto;display: block;" class="vidyard-player-embed" src="https://play.vidyard.com/Pzht5TWZYmh74gvk38QPUg.jpg" data-uuid="Pzht5TWZYmh74gvk38QPUg" data-v="4" data-type="inline" width="100%"/></div> But of course there’s more, like what’s coming up next. We have plans to allow you to use Kibana's saved searches to be the input for a threshold alert since those are fairly common and currently used in other areas of Kibana. We also plan to build out more UIs for other alerting use cases, such as comparing today’s value with last week’s value and alerting when the change goes&nbsp;beyond a certain threshold. Go use this feature&nbsp;and check out our <a href="https://www.elastic.co/guide/en/kibana/6.0/watcher-ui.html">documentation</a> for more details. As you dive into the 6.0 preview releases, we'd love to hear your feedback as part of our <a href="https://www.elastic.co/blog/elastic-pioneer-program-6-0" target="_blank">Pioneer Program</a>. Your insights make&nbsp;our software better!

Screen Shot 2017-09-12 at 4.37.01 PM.png

Screen Shot 2017-09-12 at 3.40.08 PM.png

Creating a threshold alert in Elasticsearch is simpler than ever.

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Jim Unger

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

送信することにより、Elasticの<a href="/jp/legal/elastic-cloud-account-terms" target="_self">利用規約</a>を読み、同意したものと見なされます。また、上記で提供された連絡先に<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">特定の通知</a>が送信されることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシーポリシー</a>をご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.By submitting this form, I agree to Elastic sharing my contact information with Google Cloud. I also agree to Elastic giving my information to the vendor for the purpose of shipping my food package.

GDPR Text + Google Cloud

送信することにより、Elasticの<a href="/jp/legal/elastic-cloud-account-terms" target="_self">利用規約</a>を読み、同意したものと見なされます。また、関連する製品やサービスについて、上記で提供された情報を使用してElasticから<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">連絡する</a>場合があることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシー</a>ポリシーをご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。このフォームを送信することにより、Elasticが私の連絡先情報をGoogle Cloudに共有することに同意します。また、Elasticが私に食材パッケージを発送する目的で私の情報をベンダーに提供することにも同意します。

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

送信することにより、Elasticの<a href="/jp/legal/serverless-preview-terms" target="_self">利用規約</a>を読み、同意したものと見なされます。また、関連する製品やサービスについて、上記で提供された情報を使用してElasticから<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">連絡する</a>場合があることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシー</a>ポリシーをご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

送信することにより、<a href="/jp/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud利用規約</a>に同意したものとみなされます。個人情報は<a href="/jp/legal/privacy-statement">Elasticのプライバシーポリシー</a>に基づいて取り扱われます。

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

送信することにより、Elasticの<a href="/jp/legal/terms-of-use" target="_self">利用規約</a>を読み、同意したものと見なされます。また、関連する製品やサービスについて、上記で提供された情報を使用してElasticから<a href="/jp/legal/privacy-statement#how-we-use-the-information" target="_self">連絡する</a>場合があることを認めたことになります。詳細については、<a href="/jp/legal/privacy-statement/" target="_self">Elasticのプライバシー</a>ポリシーをご覧ください。これらの同意についてはいつでもオプトアウトすることが可能です。

Explore similar demos

Overview

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

このページのコンテンツは、選択された言語ではご利用いただけません。Elasticでは現在、コンテンツをさまざまな言語でご利用いただけるよう取り組んでいます。お使いの言語が準備されるまでお待ちくださるようお願いいたします。

Author

Articles by

Watch now (no PT)

Watch now

See all top stories

すべてのトップストーリーを見る

All (no PT translation)

Contact information

Press Release

Share on Reddit

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Load More

Share on LinkedIn

Search Integrations

All Solutions

Video for

See when this webinar starts in my time zone

現在のタイムゾーンでこのウェビナー開始時間を見る

Register to Watch

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

他の予定と重なってしまった…という場合も、問題ありません。参加登録されると、録画配信をご利用いただけます。関連コンテンツのご案内もメールでお届けします。

Author

Articles by Jim Unger

Creating a threshold alert in Elasticsearch is simpler than ever.

Sign up for Elastic Cloud free trial