# Per document monitor does not support filebeat data stream?

**URL:** <https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818>\
**Category:** Alerting\
**Created:** [July 18, 2025, 4:09am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818 "2025-07-18T04:09:34Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 18, 2025, 4:09am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/1 "2025-07-18T04:09:35Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
2.9

target: per document monitor on filebeat data stream to capture SSH event to send out email

issue: no filebeat data stream / index shown on index selection

 ![no_index](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/2/282100b5a67d76956bd6ea07c585abb996659510.jpeg)

as not succeed in UI, tried to use API `POST _plugins/_alerting/monitors`  
[](https://i.ibb.co/LDqkprkd/api1.jpg)

 ![api2](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/93681a3f76ee997c364abe850a887c0d156a6e4c.jpeg)  
checked json format ok and seems related index not found issue  
from internet, any thing related to permission? cross cluster index?  
for permission, it should be ok as that is admin account  
and there is only one cluster  
thanks for any hints

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 18, 2025, 10:01am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/2 "2025-07-18T10:01:46Z")

</div>

Hi @igs-employee ,

From the above, you’re using Filebeat to send logs to Opensearch and from these logs you would like to create an alert on each ssh attempt and for it to prompt an email as a result.

Lets. first figure out a few questions:

- are these ssh events being monitored and is Filebeats sending them to Opensearch?
- Can you see and send a sample of these events?
- Which index are these events being sent to?
- Are you querying the index which contains these logs in the per document monitor you’re trying to create?

Let me know when you validated and tested the above. You can also send on any sample information to show your validations,

Leeroy.

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 18, 2025, 11:35am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/3 "2025-07-18T11:35:32Z")

</div>

filebeat → opensearch → data stream filebeat-8.18.2 → .ds-filebeat-8.18.2-000025 (index from data stream)

 ![filebeat_sameple1](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/0326082a2a5e253ca3baa18f62e1d81f2f8ecdc0.jpeg)

trying to query such log in per document monitor

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 18, 2025, 11:36am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/4 "2025-07-18T11:36:47Z")

</div>

![filebeat_sameple2](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/1e6764d5e8e7e5a000ab964ea753a9efd417d74b.jpeg)  
full document

1st pic in 1st post shows filebeat related index not shown in “select index”

---

<div class="post-metadata">

**Author:** ![MHR](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@MHR](https://forum.opensearch.org/u/MHR)\
**Post date:** [July 18, 2025, 12:28pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/5 "2025-07-18T12:28:45Z")

</div>

Hi, Can you share the body of POST \_plugins/\_alerting/monitors ?

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 18, 2025, 3:15pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/6 "2025-07-18T15:15:49Z")

</div>

POST \_plugins/\_alerting/monitors  
{  
“type”: “monitor”,  
“name”: “test\_monitor”,  
“monitor\_type”: “doc\_level\_monitor”,  
“enabled”: true,  
“schedule”: {  
“period”: {  
“interval”: 1,  
“unit”: “MINUTES”  
}  
},  
“inputs”: [  
{  
“doc\_level\_input”: {  
“indices”: [“filebeat-\*”],  
“queries”: [  
{  
“id”: “q1”,  
“name”: “test\_query”,  
“query”: {  
“match\_all”: {}  
}  
}  
]  
}  
}  
],  
“triggers”:   
}

---

<div class="post-metadata">

**Author:** ![MHR](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@MHR](https://forum.opensearch.org/u/MHR)\
**Post date:** [July 18, 2025, 3:39pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/7 "2025-07-18T15:39:56Z")

</div>

Trigger is mandatory for per document monitor, can you try to add a simple trigger

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 18, 2025, 4:00pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/8 "2025-07-18T16:00:07Z")

</div>

Hey @igs-employee ,

I done some testing on the version you’re running and I did find a workaround you can use to do it via the UI.

Although it is a workaround and I do recommend you log an issue for a feature request to be added. - [GitHub · Where software is built](https://github.com/opensearch-project/.github/issues)

1. Go to Notifications and add a channel required for your alert (this is the trigger @MHR is referring to)
2. Next through the UI you can create a monitor like before, I suggest testing first with a field that will stay the same. i.e event.action = ssh\_login.

To get the workaround working encompass the index with wildcards and ignore the warning.

 ![Screenshot from 2025-07-18 16-37-28](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/d7d4bef98688696c21d27ae79ec8a4b706990dde.png)

Then when you’ve filled out everything, save the alert and then force some ssh logs. The monitor will work and you will be prompted alerts without having to create via the API.

Hopefully this helps,

Leeroy.

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 18, 2025, 4:15pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/9 "2025-07-18T16:15:07Z")

</div>

POST \_plugins/\_alerting/monitors  
{  
“type”: “monitor”,  
“name”: “test\_monitor”,  
“monitor\_type”: “doc\_level\_monitor”,  
“enabled”: true,  
“schedule”: {  
“period”: {  
“interval”: 1,  
“unit”: “MINUTES”  
}  
},  
“inputs”: [  
{  
“doc\_level\_input”: {  
“indices”: [“filebeat-\*”],  
“queries”: [  
{  
“id”: “q1”,  
“name”: “test\_query”,  
“query”: {  
“match\_all”: {}  
}  
}  
]  
}  
}  
],  
“triggers”: [ { “document\_level\_trigger”: {  
“name”: “test-trigger”,  
“severity”: “1”,  
“condition”: {  
“script”: {  
“source”: “(query[name=sigma-123] || query[tag=tag3]) && query[name=sigma-789]”,  
“lang”: “painless”  
}  
},  
“actions”: [  
{  
“name”: “test-action”,  
“destination\_id”: “E4o5hnsB6KjPKmHtpfCA”,  
“message\_template”: {  
“source”: “”“Monitor just entered alert status. Please investigate the issue. Related Finding Ids: {{ctx.alerts.0.finding\_ids}}, Related Document Ids: {{ctx.alerts.0.related\_doc\_ids}}”“”,  
“lang”: “mustache”  
},  
“action\_execution\_policy”: {  
“action\_execution\_scope”: {  
“per\_alert”: {  
“actionable\_alerts”:   
}  
}  
},  
“subject\_template”: {  
“source”: “The Subject”,  
“lang”: “mustache”  
}  
}  
]  
}}]  
}

{  
“error”: {  
“root\_cause”: [  
{  
“type”: “alerting\_exception”,  
“reason”: “Can’t get text on a START\_OBJECT at 20:22”  
}  
],  
“type”: “alerting\_exception”,  
“reason”: “Can’t get text on a START\_OBJECT at 20:22”,  
“caused\_by”: {  
“type”: “exception”,  
“reason”: “java.lang.IllegalStateException: Can’t get text on a START\_OBJECT at 20:22”  
}  
},  
“status”: 500  
}

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 18, 2025, 4:26pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/10 "2025-07-18T16:26:19Z")

</div>

version difference?  
in my page, that is “select data”.  
while your page “Data source”

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 18, 2025, 4:32pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/11 "2025-07-18T16:32:02Z")

</div>

What exact version are you using? You said 2.9? did you test it either way?

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 18, 2025, 11:40pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/12 "2025-07-18T23:40:48Z")

</div>

testing on 2.9.2

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 19, 2025, 7:04pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/13 "2025-07-19T19:04:16Z")

</div>

@igs-employee is it 2.9.2 or 2.19.2?

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 20, 2025, 1:19pm UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/14 "2025-07-20T13:19:52Z")

</div>

so sorry, my bad  
double checked 2.19.2  
keep entering 2.9…

---

<div class="post-metadata">

**Author:** ![igs-employee](https://avatars.discourse-cdn.com/v4/letter/i/b5a626/32.png) [@igs-employee](https://forum.opensearch.org/u/igs-employee)\
**Post date:** [July 21, 2025, 10:07am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/15 "2025-07-21T10:07:53Z")

</div>

finally it works. thanks

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [July 21, 2025, 11:16am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/16 "2025-07-21T11:16:49Z")

</div>

That’s great news! no worries on the version. Glad it is working for you now!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [September 19, 2025, 11:17am UTC](https://forum.opensearch.org/t/per-document-monitor-does-not-support-filebeat-data-stream/25818/17 "2025-09-19T11:17:16Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.