Answers: <p>You can use emergent AI based alerts by <a href="http://totalcloud.io" rel="nofollow noreferrer">totalcloud</a>. You can customize the thresholds and see a dry run of the alarms too.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-17T14:22:05.753Z
Answers: 2017-08-17T14:22:05.753Z
Answers: Veer Abheek Singh Manhas
Answers: <blockquote>
    <p>Manage alarms through Kibana</p>
  </blockquote>
  
  <p>That specifically is one of the licensing points for X-Pack, so there won't be much non-X-pack stuff out there that does this.</p>
  
  <p>I've been doing alarms through Logstash config, but it isn't managed through X-Pack. We've had better luck managing logstash <code>output {}</code> blocks through GitHub-style pull-request workflows. It will require knowing how to write logstash code, and some sense of the object model of your events. But if people are fluent in writing Kibana dashboards, they already have that fluency; most of your training will be in scoping the logstash code.</p>
  
Answers: CC BY-SA 4.0
Answers: 2018-08-19T18:50:52.560Z
Answers: 2018-08-19T18:50:52.560Z
Answers: sysadmin1138
Answers: <p>I have no experience with it myself, but Elastalert (<a href="http://elastalert.readthedocs.io/en/latest/elastalert.html" rel="noreferrer">http://elastalert.readthedocs.io/en/latest/elastalert.html</a>) sounds like what you need (for the alarms/threshold part)</p>
  
  <p>But besides that, it sounds like your interested in monitoring. In my opinion ELK is not a classic monitoring tool (more: data collection, data processing and data visualization). You should take a look at Icinga2 (<a href="https://www.icinga.com/products/icinga-2/" rel="noreferrer">https://www.icinga.com/products/icinga-2/</a>) which can can be configured highly dynamical and is compatible with nagios plugins</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-20T12:07:09.667Z
Answers: plus one for Elastalert, its surprisingly powerful.
Answers: Trondh
Answers: CC BY-SA 3.0
Answers: 2017-05-18T12:06:00.457Z
Answers: 2017-05-18T12:06:00.457Z
Answers: Fabian
Body: <p>I'm working on my first implementation of the Elasticsearch-Logstash-Kibana stack. I have everything working, but now I need to:</p>
  
  <ul>
  <li>Set alarms on certain thresholds/events</li>
  <li>Send notifications on alarms</li>
  <li>(desirable) Manage alarms from within Kibana (i.e. alert/acknowledge)</li>
  </ul>
  
  <p>I've read some partial solutions using another tools beside ELK, as Nagios, but I'm wondering what is the industry's "best" approach to this need.</p>
  
  <p><strong>Note</strong>: I've already taken a look at X-Pack and seems to be one of the acceptable solutions, but the licencing details and costs are still vague - not publicly available. I've contacted Elastic but need to answer a few questions with data I still don't have.</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-05-17T13:37:05.217Z
Comments: Have a look at x-pack if you're on the version 5 of the stack
Comments: Tensibai
Tags: <monitoring><notifications>
Title: Alarms management with Elasticsearch and Kibana
UserDisplayName: niglesias
ThreadText: # Alarms management with Elasticsearch and Kibana
  
  (Asked by: username_0 on 2017-05-17)
  
  I'm working on my first implementation of the Elasticsearch-Logstash-Kibana stack. I have everything working, but now I need to:
  
  * Set alarms on certain thresholds/events
  * Send notifications on alarms
  * (desirable) Manage alarms from within Kibana (i.e. alert/acknowledge)
  
  I've read some partial solutions using another tools beside ELK, as Nagios, but I'm wondering what is the industry's "best" approach to this need.
  
  **Note**: I've already taken a look at X-Pack and seems to be one of the acceptable solutions, but the licencing details and costs are still vague - not publicly available. I've contacted Elastic but need to answer a few questions with data I still don't have.
  
  **Tags:** monitoring, notifications
  
  > **Comments:**
  > **username_1**: Have a look at x-pack if you're on the version 5 of the stack  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_4 on 2017-05-18. Score: 7 | Accepted answer
  
  I have no experience with it myself, but Elastalert (<http://elastalert.readthedocs.io/en/latest/elastalert.html>) sounds like what you need (for the alarms/threshold part)
  
  But besides that, it sounds like your interested in monitoring. In my opinion ELK is not a classic monitoring tool (more: data collection, data processing and data visualization). You should take a look at Icinga2 (<https://www.icinga.com/products/icinga-2/>) which can can be configured highly dynamical and is compatible with nagios plugins
  
  > **Comments:**
  > **username_5**: plus one for Elastalert, its surprisingly powerful.  
  
  ---
  
  ### Answer by username_2 on 2017-08-17. Score: 0
  
  You can use emergent AI based alerts by [totalcloud](http://totalcloud.io). You can customize the thresholds and see a dry run of the alarms too.
  
  
  ---
  
  ### Answer by username_3 on 2018-08-19. Score: 0
  
  > Manage alarms through Kibana
  
  That specifically is one of the licensing points for X-Pack, so there won't be much non-X-pack stuff out there that does this.
  
  I've been doing alarms through Logstash config, but it isn't managed through X-Pack. We've had better luck managing logstash `output {}` blocks through GitHub-style pull-request workflows. It will require knowing how to write logstash code, and some sense of the object model of your events. But if people are fluent in writing Kibana dashboards, they already have that fluency; most of your training will be in scoping the logstash code.
  
  
  ---
  
  