# Detection of complex conditions

**URL:** <https://forum.opensearch.org/t/detection-of-complex-conditions/21612>\
**Category:** Alerting\
**Tags:** configure\
**Created:** [September 23, 2024, 3:03pm UTC](https://forum.opensearch.org/t/detection-of-complex-conditions/21612 "2024-09-23T15:03:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![t.naka](https://avatars.discourse-cdn.com/v4/letter/t/65b543/32.png) [@t.naka](https://forum.opensearch.org/u/t.naka)\
**Post date:** [September 23, 2024, 3:03pm UTC](https://forum.opensearch.org/t/detection-of-complex-conditions/21612/1 "2024-09-23T15:03:07Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
opensearch 2.11

**Describe the issue** :  
Hello

I would like to use the alerting function to detect when the following two conditions are met.  
・I want to submit two queries (because each search time axis is different)  
・I want to perform a second search using the results of the first search as arguments.

I am verifying this while reading the official documentation, but is it currently not possible to implement it?  
I am aware of a method to achieve this by detecting with one query, passing it to another service using a trigger, and calling the second query from the other service.  
I would like to know if there is a way to achieve this with only one monitor setting.

The closest thing would be to use the composite monitor function, but it would be nice to be able to set the first query result as an argument for the second query.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 25, 2024, 11:17pm UTC](https://forum.opensearch.org/t/detection-of-complex-conditions/21612/2 "2024-09-25T23:17:23Z")

</div>

@t.naka I’ve checked the documentation and you’re correct.  
All of the monitors execute a single query. The composite monitor can use multiple monitors to trigger alerts in a sequence. But they don’t relay on each other and don’t share the results between themselves.

---

<div class="post-metadata">

**Author:** ![t.naka](https://avatars.discourse-cdn.com/v4/letter/t/65b543/32.png) [@t.naka](https://forum.opensearch.org/u/t.naka)\
**Post date:** [September 27, 2024, 7:58am UTC](https://forum.opensearch.org/t/detection-of-complex-conditions/21612/3 "2024-09-27T07:58:09Z")

</div>

Thank you for your answer.

Currently, the only way to achieve what I want is to use the trigger function to send a second query from Lambda or something similar.

I think there is a demand for complex monitor functions, so I would like to close this question in the hope that OpenSearch’s monitor function will be enhanced to be complete on its own.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 27, 2024, 9:46am UTC](https://forum.opensearch.org/t/detection-of-complex-conditions/21612/4 "2024-09-27T09:46:49Z")

</div>

@t.naka If you’d like to see such functionality in OpenSearch Dashboards, you can open a Feature Request in the [OpenSearch GitHub.](https://github.com/opensearch-project/alerting-dashboards-plugin/issues)  
If you do so, please share the link in this thread.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [November 26, 2024, 9:47am UTC](https://forum.opensearch.org/t/detection-of-complex-conditions/21612/5 "2024-11-26T09:47:35Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.