Tags: Alerting
By Sergii Bondarenko
This post walks you through the graph mode of the Signals Alerting Kibana app and shows how to generate watches and notifications with a few simple clicks.
The Signals Kibana app is distributed as part of the Search Guard Kibana app. To use Signals, we need to install Search Guard Elasticsearch and Kibana plugins.

Add some data

First, we need to add the Kibana sample data in order to have some data in Elasticsearch to play with.
For this walk-through, we use the sample flight data.

Find Signals

Find the Signals icon on the left menu or replace kibana with searchguard-signals in the browser URL, for example:
1 Alerting Signals Navigation
Now you see Signals home page with an empty table. In the next chapter, we learn how to use Signals.
2 Elasticsearch Alerting Signals Main Screen

How it works

A watch is an alert configuration. Discover how it works before proceeding with this tutorial.

Wizard watch


Click the New button to create a new watch.
3 Elasticsearch Alerting Create New Watch
First, choose a telling name for your new watch.
4 elasticsearch alerting watch name
As a next step, we define how often we want the watch to run. We want to run it every 5 minutes, which be configure by setting an interval trigger:
5 elasticsearch alerting trigger interval
Select kibanasampledata_flights index and timestamp for the time field.
6 elasticsearch alerting select index

Search query

Now you see a visualization rendered below. The visualization shows all documents count change over the last 1 hour.
7 elasticsearch alerting count query
Now let’s configure the watch to show us the average flight ticket price change over the last 1 hour. Select average() from WHEN expression.
8 elasticsearch alerting average search
Then select AvgTicketPrice from OF expression and see the visualization changed. Below the visualization is Query stat where you can see the related Elasticsearch query performance.
9 elasticsearch alerting query stats


We want to get informed when the average ticker price is below a certain threshold. So we set the threshold to IS BELOW 1000.
10 elasticsearch alerting below thresholf

Adding actions

In the next part of this series we will add an action that is being executed when our condition is met. Stay tuned!

Where to go next

Image: shutterstock / Champ008
Published: 2020-02-03
linkedIn icon
y icon
Questions? Drop us a line!
your message
This form collects your name and email. Please take a look in our privacy policy for a better understanding on how we protect and manage your submitted data.
Other posts you may like
follow us
twitter iconfacebook iconlinkedIn iconyoutube icon
Search Guard Newsletter
For the latest product developments, new versions and cybersecurity news, sign up to our newsletter.