# Alerting **URL:** https://forum.opensearch.org/c/plugins/alerting/7.md?page=1 [Latest](https://forum.opensearch.org/latest.md) · [Categories](https://forum.opensearch.org/categories.md) · [Tags](https://forum.opensearch.org/tags.md) **Page:** 2 --- ## [SMTP notification error "Could not convert socket to TLS"](https://forum.opensearch.org/t/smtp-notification-error-could-not-convert-socket-to-tls/22805)
**Author:** [@latituder](https://forum.opensearch.org/u/latituder)\ **Replies:** 1\ **Last updated:** [December 16, 2024, 8:58am UTC](https://forum.opensearch.org/t/smtp-notification-error-could-not-convert-socket-to-tls/22805 "2024-12-16T08:58:30Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.18.0 Describe the issue: my smtp server requires start\_tls. I tried to send a test email based on my smtp configuration, got: “delivery\_status”: { “st… --- ## [How to change Alerting Timezone](https://forum.opensearch.org/t/how-to-change-alerting-timezone/2000)
**Author:** [@vivekshwarup](https://forum.opensearch.org/u/vivekshwarup)\ **Replies:** 6\ **Last updated:** [December 2, 2024, 6:36pm UTC](https://forum.opensearch.org/t/how-to-change-alerting-timezone/2000 "2024-12-02T18:36:40Z")
Hello, How to change alerting timezone - (Period start: {{ctx.periodStart}} and - Period end: {{ctx.periodEnd}}. - Period start: 2019-12-12T04:02:24Z and - Period end: 2019-12-12T04:03:24Z) from UTC to IST. Thanks --- ## [Date format in alerting action](https://forum.opensearch.org/t/date-format-in-alerting-action/3908)
**Author:** [@boehmerm](https://forum.opensearch.org/u/boehmerm)\ **Replies:** 2\ **Last updated:** [December 2, 2024, 6:35pm UTC](https://forum.opensearch.org/t/date-format-in-alerting-action/3908 "2024-12-02T18:35:08Z")
Variables ctx.periodStart and ctx.periodEnd return the UTC time. As this time is send as email to the end user via webhook, it shall be formated in a user frendly format in the local timezone. Is there a way how to achie… --- ## [How can we set the {{ctx.periodStart}} timezone from UTC to IST](https://forum.opensearch.org/t/how-can-we-set-the-ctx-periodstart-timezone-from-utc-to-ist/9545)
**Author:** [@yogesh\_zyzz](https://forum.opensearch.org/u/yogesh_zyzz)\ **Replies:** 4\ **Last updated:** [December 2, 2024, 6:22pm UTC](https://forum.opensearch.org/t/how-can-we-set-the-ctx-periodstart-timezone-from-utc-to-ist/9545 "2024-12-02T18:22:08Z")
Hello, I’m trying to send slack alert in which I want to set the {{ctx.periodStart}} to be displayed in IST. Hoping for help. Thank you. --- ## [Cluster and index permissions necessary for cross-cluster Alerting](https://forum.opensearch.org/t/cluster-and-index-permissions-necessary-for-cross-cluster-alerting/22593)
**Author:** [@yo\_karamfilova](https://forum.opensearch.org/u/yo_karamfilova)\ **Replies:** 0\ **Last updated:** [November 27, 2024, 9:47am UTC](https://forum.opensearch.org/t/cluster-and-index-permissions-necessary-for-cross-cluster-alerting/22593 "2024-11-27T09:47:25Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 2.17 Describe the issue: We are not able to access cross-cluster Alerting management with any custom or reserved role except from the all\_access … --- ## [NullPointerException error](https://forum.opensearch.org/t/nullpointerexception-error/22546)
**Author:** [@DashamoolmDamu](https://forum.opensearch.org/u/DashamoolmDamu)\ **Replies:** 0\ **Last updated:** [November 22, 2024, 2:13pm UTC](https://forum.opensearch.org/t/nullpointerexception-error/22546 "2024-11-22T14:13:30Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch - 2.13.0 Alerting plugin - 2.13.0.0 Environment - Docker Server OS - Ubuntu 20.04.6 Describe the issue: I added some alert monitors and it in… --- ## [How to access document data (e.g. error message) in alert message using "Per document monitor" with "Extraction Query" (OpenSearch Alerting)](https://forum.opensearch.org/t/how-to-access-document-data-e-g-error-message-in-alert-message-using-per-document-monitor-with-extraction-query-opensearch-alerting/22392)
**Author:** [@FaisalDevOps](https://forum.opensearch.org/u/FaisalDevOps)\ **Replies:** 1\ **Last updated:** [November 20, 2024, 5:34pm UTC](https://forum.opensearch.org/t/how-to-access-document-data-e-g-error-message-in-alert-message-using-per-document-monitor-with-extraction-query-opensearch-alerting/22392 "2024-11-20T17:34:00Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Hi I have configure OpenSearch Alert and giving query which will extract “logEvents.message”: containing error message .The query running fine and giving lo… --- ## [\[alerting\_exception\] Invalid owner field when try to save Alerting Monitor](https://forum.opensearch.org/t/alerting-exception-invalid-owner-field-when-try-to-save-alerting-monitor/22408)
**Author:** [@antoniogagliardi.com](https://forum.opensearch.org/u/antoniogagliardi.com)\ **Replies:** 0\ **Last updated:** [November 13, 2024, 1:30pm UTC](https://forum.opensearch.org/t/alerting-exception-invalid-owner-field-when-try-to-save-alerting-monitor/22408 "2024-11-13T13:30:04Z")
Versions winlogbeat 7.12.1 oss OpenSearch 2.18.0 Dashboard 2.18.0 Server OS - Windows server 2022 Browser - Mozilla Firefox Describe the issue: I want to use opensearch to collect windows event log , by using w… --- ## [What does mean actionable alerts on action configuration of bucket monitor?](https://forum.opensearch.org/t/what-does-mean-actionable-alerts-on-action-configuration-of-bucket-monitor/22383)
**Author:** [@kiyoshi\_egawa](https://forum.opensearch.org/u/kiyoshi_egawa)\ **Replies:** 0\ **Last updated:** [November 12, 2024, 12:42am UTC](https://forum.opensearch.org/t/what-does-mean-actionable-alerts-on-action-configuration-of-bucket-monitor/22383 "2024-11-12T00:42:01Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 1.38 Describe the issue: Some alerts don’t act I expect. Configuration: Relevant Logs or Screenshots: --- ## [Alerting Action Throttling not working](https://forum.opensearch.org/t/alerting-action-throttling-not-working/21964)
**Author:** [@coding-jodl](https://forum.opensearch.org/u/coding-jodl)\ **Replies:** 1\ **Last updated:** [October 16, 2024, 8:59pm UTC](https://forum.opensearch.org/t/alerting-action-throttling-not-working/21964 "2024-10-16T20:59:32Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 2.17.1 Describe the issue: I have multiple monitors set up, from type “Per query monitor” and with defining method either “Visual editor” or “Ex… --- ## [Per Document Monitoring, get the Monitoring ID & Alert ID sent with message](https://forum.opensearch.org/t/per-document-monitoring-get-the-monitoring-id-alert-id-sent-with-message/21426)
**Author:** [@HarryPottar](https://forum.opensearch.org/u/HarryPottar)\ **Replies:** 2\ **Last updated:** [October 8, 2024, 8:20pm UTC](https://forum.opensearch.org/t/per-document-monitoring-get-the-monitoring-id-alert-id-sent-with-message/21426 "2024-10-08T20:20:50Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): v.2.16.0 Describe the issue: I want to thank everyone for helping me with a newbie. I have most things working as expected. My last challenge is getting t… --- ## [Alert maintenance windows](https://forum.opensearch.org/t/alert-maintenance-windows/21495)
**Author:** [@GRobertson](https://forum.opensearch.org/u/GRobertson)\ **Replies:** 1\ **Last updated:** [October 8, 2024, 6:53pm UTC](https://forum.opensearch.org/t/alert-maintenance-windows/21495 "2024-10-08T18:53:56Z")
Are there any plans to introduce maintenance windows for Alerts? We have planned downtime and don’t want alerts during this period. How are others handling this common scenario? --- ## [Is there an OS counterpart to Grafana alert pending logic?](https://forum.opensearch.org/t/is-there-an-os-counterpart-to-grafana-alert-pending-logic/21768)
**Author:** [@mariaDE9](https://forum.opensearch.org/u/mariaDE9)\ **Replies:** 0\ **Last updated:** [October 3, 2024, 9:42am UTC](https://forum.opensearch.org/t/is-there-an-os-counterpart-to-grafana-alert-pending-logic/21768 "2024-10-03T09:42:52Z")
Versions: Opensearch v 2.6.0 Is there an OS counterpart to Grafana alert pending logic? When the condition is first breached, the rule goes into a “pending” state. The rule stays in the “pending” state until the con… --- ## [Detection of complex conditions](https://forum.opensearch.org/t/detection-of-complex-conditions/21612)
**Author:** [@t.naka](https://forum.opensearch.org/u/t.naka)\ **Replies:** 3\ **Last updated:** [September 27, 2024, 9:46am UTC](https://forum.opensearch.org/t/detection-of-complex-conditions/21612 "2024-09-27T09:46:49Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): opensearch 2.11 Describe the issue: Hello I would like to use the alerting function to detect when the following two conditions are met. ・I want to submi… --- ## [Alerting-Feature: sample\_documents for ctx.dedupedAlerts and ctx.completedAlerts](https://forum.opensearch.org/t/alerting-feature-sample-documents-for-ctx-dedupedalerts-and-ctx-completedalerts/21522)
**Author:** [@hm21](https://forum.opensearch.org/u/hm21)\ **Replies:** 1\ **Last updated:** [September 18, 2024, 6:58pm UTC](https://forum.opensearch.org/t/alerting-feature-sample-documents-for-ctx-dedupedalerts-and-ctx-completedalerts/21522 "2024-09-18T18:58:29Z")
Hello @AWSHurneyt , is there progress relating the following feature? Alerting: sample\_documents for ctx.dedupedAlerts and ctx.completedAlerts - Plugins / Alerting - OpenSearch There was also an issue created for that… --- ## [Alert monitor in make query in script more than (50) value to get data](https://forum.opensearch.org/t/alert-monitor-in-make-query-in-script-more-than-50-value-to-get-data/21470)
**Author:** [@naman](https://forum.opensearch.org/u/naman)\ **Replies:** 0\ **Last updated:** [September 16, 2024, 5:07am UTC](https://forum.opensearch.org/t/alert-monitor-in-make-query-in-script-more-than-50-value-to-get-data/21470 "2024-09-16T05:07:26Z")
hello i am using latest version of opensearch this is my alert monitor in Extraction query editor i want get only usage\_percentage value more than → 50 how to make query like this { "size": 1, "query": { "bo… --- ## [How to config SMTP sender with OAUTH2 for Microsoft Exchange Online (Azure)?](https://forum.opensearch.org/t/how-to-config-smtp-sender-with-oauth2-for-microsoft-exchange-online-azure/21220)
**Author:** [@javad](https://forum.opensearch.org/u/javad)\ **Replies:** 2\ **Last updated:** [September 11, 2024, 11:10am UTC](https://forum.opensearch.org/t/how-to-config-smtp-sender-with-oauth2-for-microsoft-exchange-online-azure/21220 "2024-09-11T11:10:08Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.16.0 Describe the issue: I would like to config SMTP sender for microsoft online mail service; however, basic authentication is depricated (Deprecation o… --- ## [Show match info in the alerts](https://forum.opensearch.org/t/show-match-info-in-the-alerts/21206)
**Author:** [@anon37643724](https://forum.opensearch.org/u/anon37643724)\ **Replies:** 1\ **Last updated:** [September 9, 2024, 12:13pm UTC](https://forum.opensearch.org/t/show-match-info-in-the-alerts/21206 "2024-09-09T12:13:57Z")
Versions and technical info: OpenSearch: v 2.11.0 Browser: Firefox Webhook: Teams Describe the issue: Hi everyone, I’m trying to create some alerts when there are some new documents in an index, I finally could crea… --- ## [Mustache Template function / Removing trailing comma?](https://forum.opensearch.org/t/mustache-template-function-removing-trailing-comma/2528)
**Author:** [@Dandy](https://forum.opensearch.org/u/Dandy)\ **Replies:** 12\ **Last updated:** [September 8, 2024, 9:57am UTC](https://forum.opensearch.org/t/mustache-template-function-removing-trailing-comma/2528 "2024-09-08T09:57:09Z")
What do we do when dealing with JSON object on webhooks? Current templating with aggregations basically makes it impossible due to trailing commas. For example, using any kind of templating requires iterations over an o… --- ## [Visual editor add multiple values to query](https://forum.opensearch.org/t/visual-editor-add-multiple-values-to-query/21164)
**Author:** [@HarryPottar](https://forum.opensearch.org/u/HarryPottar)\ **Replies:** 1\ **Last updated:** [September 6, 2024, 9:52am UTC](https://forum.opensearch.org/t/visual-editor-add-multiple-values-to-query/21164 "2024-09-06T09:52:59Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): v2.16.0 Describe the issue: I’m still new but getting there. I have a working per-document monitor; I’m using the visual editor while I’m learning. I hav… --- ## [Unable to access Documents Fields (Per Document Monitor Alerts)](https://forum.opensearch.org/t/unable-to-access-documents-fields-per-document-monitor-alerts/20465)
**Author:** [@Kmrs97](https://forum.opensearch.org/u/Kmrs97)\ **Replies:** 1\ **Last updated:** [September 6, 2024, 12:35am UTC](https://forum.opensearch.org/t/unable-to-access-documents-fields-per-document-monitor-alerts/20465 "2024-09-06T00:35:06Z")
Hello, I am using the latest version of OpenSearch and OpenSearch Dashboards. My goal is to check if each document indexed in a specified index pattern matches a specific field, and if it does, send an alert to a custom … --- ## [How to get hits data in message](https://forum.opensearch.org/t/how-to-get-hits-data-in-message/21011)
**Author:** [@naman](https://forum.opensearch.org/u/naman)\ **Replies:** 4\ **Last updated:** [September 4, 2024, 1:25pm UTC](https://forum.opensearch.org/t/how-to-get-hits-data-in-message/21011 "2024-09-04T13:25:49Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): opensearch 2.16version this is below is my hits in alert { "\_shards": { "total": 1, "failed": 0, "successful": 1, "skip… --- ## [How to get system index(.opendistro-alerting-alerts) in alerting in monitor](https://forum.opensearch.org/t/how-to-get-system-index-opendistro-alerting-alerts-in-alerting-in-monitor/20601)
**Author:** [@naman](https://forum.opensearch.org/u/naman)\ **Replies:** 4\ **Last updated:** [August 23, 2024, 1:21am UTC](https://forum.opensearch.org/t/how-to-get-system-index-opendistro-alerting-alerts-in-alerting-in-monitor/20601 "2024-08-23T01:21:35Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): opensearch version 2.15 opensearch dashboard version 2.15 hii There i want get system index (.opendistro-alerting-alerts) in alerting in monitor (Per quer… --- ## [Notification channels - send test mail - certificate not found](https://forum.opensearch.org/t/notification-channels-send-test-mail-certificate-not-found/20035)
**Author:** [@seeruebe](https://forum.opensearch.org/u/seeruebe)\ **Replies:** 2\ **Last updated:** [August 9, 2024, 1:38pm UTC](https://forum.opensearch.org/t/notification-channels-send-test-mail-certificate-not-found/20035 "2024-08-09T13:38:27Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): v 2.13.0/Kubernetes/Firefox Describe the issue: We are not able to send mails via STARTTLS because the certificate is not found (unable to find valid certif… --- ## [Kibana email alert - extracting field results](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606)
**Author:** [@lehner.angelica](https://forum.opensearch.org/u/lehner.angelica)\ **Replies:** 43\ **Last updated:** [August 7, 2024, 3:42pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606 "2024-08-07T15:42:25Z")
Hi everyone, I’m using a windows based Opendistro Kibana installation. In Kibana, I configured a custom Webhook in order to send email alerts using an SMTP server. Email alerts are being sent and it’s working perfectl… --- ## [How to make monitor in Extraction query editor](https://forum.opensearch.org/t/how-to-make-monitor-in-extraction-query-editor/20653)
**Author:** [@naman](https://forum.opensearch.org/u/naman)\ **Replies:** 1\ **Last updated:** [August 7, 2024, 6:18am UTC](https://forum.opensearch.org/t/how-to-make-monitor-in-extraction-query-editor/20653 "2024-08-07T06:18:54Z")
I need help to make alerting in monitor make a Per query monitor in Extraction query editor in make query like below if i get error message at 12:00 to 12:05 clock then after 12:06 to 12:10 in not get error message to… --- ## [Per query monitor in make two trigger first call when log in level error to trigger then secound after three minutes to check again get log leve error get or not get if not get to send message successfully solved error](https://forum.opensearch.org/t/per-query-monitor-in-make-two-trigger-first-call-when-log-in-level-error-to-trigger-then-secound-after-three-minutes-to-check-again-get-log-leve-error-get-or-not-get-if-not-get-to-send-message-successfully-solved-error/20435)
**Author:** [@naman](https://forum.opensearch.org/u/naman)\ **Replies:** 0\ **Last updated:** [July 22, 2024, 5:05am UTC](https://forum.opensearch.org/t/per-query-monitor-in-make-two-trigger-first-call-when-log-in-level-error-to-trigger-then-secound-after-three-minutes-to-check-again-get-log-leve-error-get-or-not-get-if-not-get-to-send-message-successfully-solved-error/20435 "2024-07-22T05:05:42Z")
i try to send mail using multiple trigger in Per query monitor there are make like this i have log in log level error if this get to send mail and after three minutes to check again log level error not get to another mai… --- ## [Log in message how to get and send in email using alert](https://forum.opensearch.org/t/log-in-message-how-to-get-and-send-in-email-using-alert/20350)
**Author:** [@naman](https://forum.opensearch.org/u/naman)\ **Replies:** 0\ **Last updated:** [July 17, 2024, 1:09pm UTC](https://forum.opensearch.org/t/log-in-message-how-to-get-and-send-in-email-using-alert/20350 "2024-07-17T13:09:43Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch : 2.15V Dashboard : 2.15V Server OS: ubuntu Browser: firefox Describe the issue: i am try to get log in message in alert this is my log bel… --- ## [How do i include a specific field in the message once alert activated](https://forum.opensearch.org/t/how-do-i-include-a-specific-field-in-the-message-once-alert-activated/19976)
**Author:** [@AlexPinko](https://forum.opensearch.org/u/AlexPinko)\ **Replies:** 0\ **Last updated:** [June 24, 2024, 11:57am UTC](https://forum.opensearch.org/t/how-do-i-include-a-specific-field-in-the-message-once-alert-activated/19976 "2024-06-24T11:57:29Z")
Hello, I followed this thread How do i include message fields in the Alert Action Message and managed to succeed in creating alerts for “per query monitor” → “extraction query editor”. My problem is that I didn’t manag… --- ## [How to detect user login from a different IP](https://forum.opensearch.org/t/how-to-detect-user-login-from-a-different-ip/19900)
**Author:** [@slowdashbash](https://forum.opensearch.org/u/slowdashbash)\ **Replies:** 1\ **Last updated:** [June 20, 2024, 8:44am UTC](https://forum.opensearch.org/t/how-to-detect-user-login-from-a-different-ip/19900 "2024-06-20T08:44:15Z")
Hi, trying to write some detection rules for my logs. I want to create a rule that detects if a user logs in from a previously not used IP address. My incoming logs look like: {"uuid":"7f8738fe72a2074a8f65f9587","create… [Previous page](https://forum.opensearch.org/c/plugins/alerting/7.md) [Next page](https://forum.opensearch.org/c/plugins/alerting/7.md?page=2)