# Kibana Alerting Setup and Testing
**URL:** https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810
**Category:** Open Source Elasticsearch and Kibana
**Created:** [February 1, 2021, 11:02pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810 "2021-02-01T23:02:15Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@FREDDIE2020](https://forum.opensearch.org/u/FREDDIE2020)
#### Post date: [February 1, 2021, 11:02pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/1 "2021-02-01T23:02:15Z")
Hello,
I am setting up a monitor and alerting trigger for log message to match on, and here is a screenshot of what I have.
Does this mean when I run this that it worked or how do I tell this worked. The destination is setup in AWS SNS.
Any help appreciated.
Thanks,
Freddie2020
---
### Author:  [@mmamaenko](https://forum.opensearch.org/u/mmamaenko)
#### Post date: [February 1, 2021, 11:29pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/2 "2021-02-01T23:29:57Z")
extraction query response shows 0 hits - query string was not found in logs. You may run query in Dev Tools and see what was found
---
### Author:  [@FREDDIE2020](https://forum.opensearch.org/u/FREDDIE2020)
#### Post date: [February 2, 2021, 2:30pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/3 "2021-02-02T14:30:29Z")
@mmamaenko
Hi
I tried the query in Dev Tools but is giving failure: Syntax error
Any ideas on how to fix this issue?
Thanks Freddie2020
---
### Author:  [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)
#### Post date: [February 2, 2021, 2:46pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/4 "2021-02-02T14:46:19Z")
Looks like you need to put in the request into dev tools on the previous line. Something like `GET {your index}/_search` then the next line is the JSON.
---
### Author:  [@FREDDIE2020](https://forum.opensearch.org/u/FREDDIE2020)
#### Post date: [February 2, 2021, 3:11pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/5 "2021-02-02T15:11:28Z")
Hello @searchymcsearchface
I ran like you said and it produced the output here:
Any ideas to get it to match for the query? As you can see it is in the log for that index.
Any info appreciated.
Thanks, Freddie 2020
---
### Author:  [@mmamaenko](https://forum.opensearch.org/u/mmamaenko)
#### Post date: [February 2, 2021, 3:53pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/6 "2021-02-02T15:53:41Z")
GET filebeat-k8sxxxx/\_search
{
“query”:{
“match\_phrase”:{
“message”:“Connection to Mongo has failed”
}
}
}
---
### Author:  [@FREDDIE2020](https://forum.opensearch.org/u/FREDDIE2020)
#### Post date: [February 2, 2021, 4:54pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/7 "2021-02-02T16:54:59Z")
@mmamaenko
So that worked.
Now, what do I put into my query for the monitor and trigger to occur?
Any help appreciated.
Thanks, Freddie 2020
---
### Author:  [@mmamaenko](https://forum.opensearch.org/u/mmamaenko)
#### Post date: [February 2, 2021, 5:44pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/8 "2021-02-02T17:44:04Z")
{
“query”: {
“bool”: {
“must”: [
{
“match”: {
“message”: {
“query”: “Connection to Mongo has failed”,
“operator”: “OR”,
“prefix\_length”: 0,
“max\_expansions”: 50,
“fuzzy\_transpositions”: true,
“lenient”: false,
“zero\_terms\_query”: “NONE”,
“auto\_generate\_synonyms\_phrase\_query”: true,
“boost”: 1
}
}
},
{
“range”: {
“time”: {
“from”: “{{period\_end}}||-1m”, \<==== adjust time range
“to”: “{{period\_end}}”,
“include\_lower”: true,
“include\_upper”: true,
“format”: “epoch\_millis”,
“boost”: 1
}
}
}
],
“adjust\_pure\_negative”: true,
“boost”: 1
}
}
}
---
### Author:  [@FREDDIE2020](https://forum.opensearch.org/u/FREDDIE2020)
#### Post date: [February 2, 2021, 10:20pm UTC](https://forum.opensearch.org/t/kibana-alerting-setup-and-testing/4810/9 "2021-02-02T22:20:17Z")
@mmamaenko
Worked great thank you so much!
Freddie2020