# Help configuring alerting monitor

**URL:** <https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343>\
**Category:** Alerting\
**Created:** [October 15, 2026, 7:15am UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343 "2026-10-15T07:15:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\
**Post date:** [October 15, 2026, 7:15am UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343/1 "2026-10-15T07:15:20Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 3.8/OSD 3.8/SLES

**Describe the issue** :

Please tell me which type of OpenSearch Alerting monitor to choose: “Per query monitor”, “Per bucket monitor”, “Per document monitor”, that will send alerts under the following condition:  
A document is critical if the message field contains at least one of the words:  
_ **error, warning, alert, failed, unavailable, lost, wrong, unable, invalid, failure** _.  
BUT the document should not be considered critical if message contains at least one of the following strings: _ **disabling inotify, user config - ignore, \_put\_session, PVE ticket, guest-ping, Cyberprotect** _. And the document should not be considered critical if the message came from the _ **sshd-session** _ service.

**Configuration** : Doc

{  
“\_source”: {  
“event”: {},  
“@timestamp”: “2026-09-17T08:42:54.000085547Z”,  
“host”: “pve3”,  
“@version”: “1”,  
“tags”: [  
“pve”  
],  
“service”: “sshd-session”,  
“type”: “syslog”,  
“message”: [  
“\<38\>Sep 17 11:42:53 pve3 sshd-session[844057]: Read error from remote host 1.1.0.1 port 111: Connection reset by peer”,  
]  
}  
}

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Yanlin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/yanlin/32/10286_2.png) [@Yanlin](https://forum.opensearch.org/u/Yanlin)\
**Post date:** [October 15, 2026, 6:21pm UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343/2 "2026-10-15T18:21:35Z")

</div>

Hi @Pan-Vad,

For an overview of the differences between per-query, per-bucket, and per-document monitors, please refer to the OpenSearch documentation:

> **[Alerting monitors](https://docs.opensearch.org/latest/observing-your-data/alerting/monitors/)**
>
> Proactively monitor your data in OpenSearch with features available in Alerting and Anomaly Detection. For example, you can pair Anomaly Detection with...

You can also find links to the detailed documentation for each monitor type on that page.

I also noticed that some of the conditions you mentioned are similar to those in your previous thread:

> [@Help configuring an OpenSearch 3.5 alerting monitor with three triggers](https://forum.opensearch.org/t/help-configuring-an-opensearch-3-5-alerting-monitor-with-three-triggers/28261):
>
> Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 3.5/OSD 3.5/Win10/Google Chrome Describe the issue: I am using OpenSearch 3.5 and need assistance configuring an Alerting Monitor. I need to create one monitor with three triggers (A, B, and C) for detecting critical events in Proxmox logs and sending email notifications. Trigger A — Critical Keywords The trigger should fire when the message field contains any of the following words, case-insensitive: error, warning, a…

Is this related to the same monitoring setup?

Kind regards,

Yanlin.

---

<div class="post-metadata">

**Author:** ![dongnx](https://avatars.discourse-cdn.com/v4/letter/d/dfb087/32.png) [@dongnx](https://forum.opensearch.org/u/dongnx)\
**Post date:** [October 16, 2026, 12:53am UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343/3 "2026-10-16T00:53:59Z")

</div>

I’d use a per query monitor here. All three of your conditions fit in one bool query, and you get one alert per run instead of one per matching line. A per document monitor works too, but it fires per document and its queries are written in query\_string syntax, which gets awkward with a long exclusion list.

Extraction query:

```json
{
  "size": 5,
  "query": {
    "bool": {
      "filter": [
        { "range": { "@timestamp": { "gte": "{{period_end}}||-5m", "lte": "{{period_end}}", "format": "epoch_millis" } } }
      ],
      "should": [
        { "match": { "message": "error warning alert failed unavailable lost wrong unable invalid failure" } }
      ],
      "minimum_should_match": 1,
      "must_not": [
        { "match_phrase": { "message": "disabling inotify" } },
        { "match_phrase": { "message": "user config - ignore" } },
        { "match_phrase": { "message": "_put_session" } },
        { "match_phrase": { "message": "PVE ticket" } },
        { "match_phrase": { "message": "guest-ping" } },
        { "match_phrase": { "message": "Cyberprotect" } },
        { "term": { "service.keyword": "sshd-session" } }
      ]
    }
  }
}

```

Trigger condition: ctx.results[0].hits.total.value \> 0

Two things to check against your mapping. If service is mapped as keyword rather than text, use “service” instead of “service.keyword”. And match on the standard analyzer does not stem, so “fail” or “errors” will not match unless you list them too. Keep the range window equal to the monitor interval so lines aren’t skipped or counted twice.

---

<div class="post-metadata">

**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\
**Post date:** [October 19, 2026, 2:30pm UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343/4 "2026-10-19T14:30:26Z")

</div>

Hello,

I need the system to send a notification for **every new matching document** , rather than only once while the condition remains true.

For example, I sent three test log entries with a 5-second delay between each command:

`logger -t 'test_pve1' 'qwerty - failed - QWERTY - 1'`  
`logger -t 'test_pve1' 'qwerty - invalid - QWERTY - 2'`  
`logger -t 'test_pve1' 'qwerty - lost - QWERTY - 3'`

with a 5-second delay between each command. As a result, I received only **one** email, whereas I expected **three** emails.

Please advise on how to configure this so that each new matching document triggers a separate notification.

Thank you.

---

<div class="post-metadata">

**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\
**Post date:** [October 19, 2026, 2:35pm UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343/5 "2026-10-19T14:35:19Z")

</div>

I read the documentation, but unfortunately it did not clarify my issue. I created a new thread because I changed the monitor condition and updated the OpenSearch version.

* * *

---

<div class="post-metadata">

**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\
**Post date:** [October 29, 2026, 10:10am UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343/6 "2026-10-29T10:10:45Z")

</div>

Do I understand correctly that the “Per document monitors” monitor type cannot work with a dynamic index?

---

<div class="post-metadata">

**Author:** ![Yanlin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/yanlin/32/10286_2.png) [@Yanlin](https://forum.opensearch.org/u/Yanlin)\
**Post date:** [November 4, 2026, 5:57pm UTC](https://forum.opensearch.org/t/help-configuring-alerting-monitor/28343/7 "2026-11-04T17:57:08Z")

</div>

Hi @Pan-Vad

Thanks for the clarification.

For generating a separate alert for each matching document, a **Per document monitor** would be the appropriate monitor type. I tested this on OpenSearch 3.8.0 and confirmed that three matching documents in a fixed index generated three separate alerts.

However, Per document monitors do not support wildcard index patterns in OpenSearch 3.8.0. When I tried creating a monitor using a wildcard pattern, I received the following error:  
`Validation Failed: 1: Index patterns are not supported for doc level monitors.`

I also tested using an index alias as an alternative. It worked with a single index, but with multiple indices, it detected new documents in the write index but not in the non-write index. After rollover, the existing monitor did not detect matching documents in the new write index. These were the results observed in my OpenSearch 3.8.0 tests.

Kind regards,  
Yanlin