<p>You can use emergent AI based alerts by <a href="http://totalcloud.io" rel="nofollow noreferrer">totalcloud</a>. You can customize the thresholds and see a dry run of the alarms too.</p>

CC BY-SA 3.0
2017-08-17T14:22:05.753Z
2017-08-17T14:22:05.753Z
Veer Abheek Singh Manhas
<blockquote>
  <p>Manage alarms through Kibana</p>
</blockquote>

<p>That specifically is one of the licensing points for X-Pack, so there won't be much non-X-pack stuff out there that does this.</p>

<p>I've been doing alarms through Logstash config, but it isn't managed through X-Pack. We've had better luck managing logstash <code>output {}</code> blocks through GitHub-style pull-request workflows. It will require knowing how to write logstash code, and some sense of the object model of your events. But if people are fluent in writing Kibana dashboards, they already have that fluency; most of your training will be in scoping the logstash code.</p>

CC BY-SA 4.0
2018-08-19T18:50:52.560Z
2018-08-19T18:50:52.560Z
sysadmin1138
<p>I have no experience with it myself, but Elastalert (<a href="http://elastalert.readthedocs.io/en/latest/elastalert.html" rel="noreferrer">http://elastalert.readthedocs.io/en/latest/elastalert.html</a>) sounds like what you need (for the alarms/threshold part)</p>

<p>But besides that, it sounds like your interested in monitoring. In my opinion ELK is not a classic monitoring tool (more: data collection, data processing and data visualization). You should take a look at Icinga2 (<a href="https://www.icinga.com/products/icinga-2/" rel="noreferrer">https://www.icinga.com/products/icinga-2/</a>) which can can be configured highly dynamical and is compatible with nagios plugins</p>

CC BY-SA 3.0
2017-08-20T12:07:09.667Z
plus one for Elastalert, its surprisingly powerful.
Trondh
CC BY-SA 3.0
2017-05-18T12:06:00.457Z
2017-05-18T12:06:00.457Z
Fabian
<p>I'm working on my first implementation of the Elasticsearch-Logstash-Kibana stack. I have everything working, but now I need to:</p>

<ul>
<li>Set alarms on certain thresholds/events</li>
<li>Send notifications on alarms</li>
<li>(desirable) Manage alarms from within Kibana (i.e. alert/acknowledge)</li>
</ul>

<p>I've read some partial solutions using another tools beside ELK, as Nagios, but I'm wondering what is the industry's "best" approach to this need.</p>

<p><strong>Note</strong>: I've already taken a look at X-Pack and seems to be one of the acceptable solutions, but the licencing details and costs are still vague - not publicly available. I've contacted Elastic but need to answer a few questions with data I still don't have.</p>

CC BY-SA 3.0
2017-05-17T13:37:05.217Z
Have a look at x-pack if you're on the version 5 of the stack
Tensibai
<monitoring><notifications>
Alarms management with Elasticsearch and Kibana
niglesias
# Alarms management with Elasticsearch and Kibana

(Asked by: username_0 on 2017-05-17)

I'm working on my first implementation of the Elasticsearch-Logstash-Kibana stack. I have everything working, but now I need to:

* Set alarms on certain thresholds/events
* Send notifications on alarms
* (desirable) Manage alarms from within Kibana (i.e. alert/acknowledge)

I've read some partial solutions using another tools beside ELK, as Nagios, but I'm wondering what is the industry's "best" approach to this need.

**Note**: I've already taken a look at X-Pack and seems to be one of the acceptable solutions, but the licencing details and costs are still vague - not publicly available. I've contacted Elastic but need to answer a few questions with data I still don't have.

**Tags:** monitoring, notifications

> **Comments:**
> **username_1**: Have a look at x-pack if you're on the version 5 of the stack  

---

## 3 answers

### Answer by username_4 on 2017-05-18. Score: 7 | Accepted answer

I have no experience with it myself, but Elastalert (<http://elastalert.readthedocs.io/en/latest/elastalert.html>) sounds like what you need (for the alarms/threshold part)

But besides that, it sounds like your interested in monitoring. In my opinion ELK is not a classic monitoring tool (more: data collection, data processing and data visualization). You should take a look at Icinga2 (<https://www.icinga.com/products/icinga-2/>) which can can be configured highly dynamical and is compatible with nagios plugins

> **Comments:**
> **username_5**: plus one for Elastalert, its surprisingly powerful.  

---

### Answer by username_2 on 2017-08-17. Score: 0

You can use emergent AI based alerts by [totalcloud](http://totalcloud.io). You can customize the thresholds and see a dry run of the alarms too.


---

### Answer by username_3 on 2018-08-19. Score: 0

> Manage alarms through Kibana

That specifically is one of the licensing points for X-Pack, so there won't be much non-X-pack stuff out there that does this.

I've been doing alarms through Logstash config, but it isn't managed through X-Pack. We've had better luck managing logstash `output {}` blocks through GitHub-style pull-request workflows. It will require knowing how to write logstash code, and some sense of the object model of your events. But if people are fluent in writing Kibana dashboards, they already have that fluency; most of your training will be in scoping the logstash code.


---

