Skip to content

Commit 05d8dbc

Browse files
nastasha-solomonmergify[bot]
authored andcommitted
[Internal][Obs UX Management][8.x]: Note filter limitation for metric threshold rules (#4961)
* First draft * fix syntax * Update docs/en/observability/metrics-threshold-alert.asciidoc * no spaces! * block * removed un-needed parenth (cherry picked from commit 2e81a76)
1 parent ea8339c commit 05d8dbc

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

docs/en/observability/metrics-threshold-alert.asciidoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,15 @@ image::images/metrics-alert-filters-and-group.png[Metric threshold filter and gr
4545

4646
The *Filters* control the scope of the rule. If used, the rule will only evaluate metric data that matches the query in this field. In this example, the rule will only alert on metrics reported from a Cloud region called `us-east`.
4747

48+
[NOTE]
49+
=====
50+
If you've made a rule with the https://www.elastic.co/docs/api/doc/kibana/operation/operation-post-alerting-rule-id[create rule API] and added Query DSL filters using the `filterQuery` parameter, the filters won't appear in the UI for editing a rule. As a workaround, manually re-add the filters through the UI and save the rule. As you're modifying the rule's filters from the UI, be mindful of the following:
51+
52+
- The **Filter** field only accepts KQL syntax, meaning you may need to manually convert your Query DSL filters to KQL.
53+
- After you save the rule, filters you've added to the **Filter** field are converted appropriately and specified in the rule's `filterQuery` parameter.
54+
55+
=====
56+
4857
The *Group alerts by* creates an instance of the alert for every unique value of the `field` added. For example, you can create a rule per host or every mount point of each host. You can also add multiple fields. In this example, the rule will individually track the status of each `host.name` in your infrastructure. You will only receive an alert about `host-1`, if `host.name: host-1` passes the threshold, but `host-2` and `host-3` do not.
4958

5059
When you select *Alert me if a group stops reporting data*, the rule is triggered if a group that previously reported metrics does not report them again over the expected time period.

0 commit comments

Comments
 (0)