# Unable to get alert - getting Error and Deleted state

**URL:** <https://forum.opensearch.org/t/unable-to-get-alert-getting-error-and-deleted-state/18205>\
**Category:** Security Analytics\
**Tags:** discuss\
**Created:** [March 1, 2024, 11:58am UTC](https://forum.opensearch.org/t/unable-to-get-alert-getting-error-and-deleted-state/18205 "2024-03-01T11:58:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abubakar](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@abubakar](https://forum.opensearch.org/u/abubakar)\
**Post date:** [March 1, 2024, 11:58am UTC](https://forum.opensearch.org/t/unable-to-get-alert-getting-error-and-deleted-state/18205/1 "2024-03-01T11:58:46Z")

</div>

Hello guys, I have created an HTTP data source pipeline and GROK processed the Linux Syslogs. Now, I have the logs in JSON and want to run detection rules on my Index which has processed logs.  
When creating the detector, I choose my data source, log type, and alert trigger, and schedule it. In my OpenSearch service logs, I see the following error:

IllegalStateException[Failed to run percolate search for sourceIndex [sys\_logs] and queryIndex [.opensearch-sap-linux-detectors-queries-000001] for 128 document(s)]; nested: SearchPhaseExecutionException[all shards failed]; nested: OpenSearchException[Query contains too many nested clauses; maxClauseCount is set to 1024];

Upon looking I was not able to get much help on the internet. I think my detector runs and most probably finds the anomaly also but when I explore Alerts I see the alert with the above error and no Findings are also there. Any help would be appreciated. Thanks

In alert panale i’m Getting Status Error and Deleted when i call following api

GET /\_plugins/\_security\_analytics/alerts?detectorType=linux

i get following error log in console

IllegalStateException[Failed to run percolate search for sourceIndex [cytex\_logs] and queryIndex [.opensearch-sap-linux-detectors-queries-000001] for 134 document(s)]; nested: SearchPhaseExecutionException[all shards failed]; nested: OpenSearchException[Query contains too many nested clauses; maxClauseCount is set to 1024];

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [April 30, 2024, 11:59am UTC](https://forum.opensearch.org/t/unable-to-get-alert-getting-error-and-deleted-state/18205/2 "2024-04-30T11:59:27Z")

</div>

Closed on April 30, 2024, 11:59am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.