Alerts are not working

[gimeb]

Should I create a separate query and associate alert with it. My understanding that I cannot set alert off the dashboard panel

[hsmith]

You should create unique queries for all of the alerts you want to have, unless I'm missing something.

[gimeb]

I have created query and alert. Please let me know if I configured it correctly. I have attached screen prints to show the steps.
1. Please let me know the reason for the dropdown list in Advanced section of the WarrantyAPI-Alert and how it should be used. See page 3.
2. Should the WarrantyAPI-Query be selected from the dropdown list (next to the Load button)? Currently, there is nothing selected. See page 2.

[hsmith]

Please let me know the reason for the dropdown list in Advanced section of the WarrantyAPI-Alert and how it should be used. See page 3.

Select the query that you saved from the dropdown. That's really all there is to it. If you need to edit the query, it can be done there, but it will be much easier to edit your saved query.

2. Should the WarrantyAPI-Query be selected from the dropdown list (next to the Load button)? Currently, there is nothing selected. See page 2.

Yeah, it should be selected from the dropdown.

[gimeb]

As you have suggested, I have selected the WarrantAPI query from the dropdown list and saved the alert. After I have opened it again there was nothing selected from the dropdown and it was empty. The query details were the same (see below) when I have selected the query from dropped down or when nothing was selected (refer to screen prints I have send to before). Therefore, please validate if I have configured alert correctly.

{"query":{"filtered":{"query":{"bool":{"should":[{"query_string":{"query":"WarrantyAPI"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1460055824720,"to":1460142224720}}}]}}}}}

[hsmith]

Can you test this query to make sure it's working correctly? Your screenshots in the previous post make it look like you've correctly set it up. As long as the query is still there, you should be fine.

[gimeb]

Please let me know that in order to set up an alert:
1. I will need to create a global or local query first
2. Configure an alert based on the query.

And this is the only way to set up an alert

Please confirm

[rkennedy]

Yes. As @hsmith mentioned -- make sure your query is working properly. Once it is, then it's time to move on to setting up the alert, as it will be based on the query.