From efc59b30abb9b9aa2d75cb51a6d279519b51ce91 Mon Sep 17 00:00:00 2001 From: Caroline <113052567+carolxob@users.noreply.github.com> Date: Mon, 17 Apr 2023 12:10:26 -0600 Subject: [PATCH] Add maximum allowed monitor number. (#3732) * Add maximum allowed monitor number. Signed-off-by: carolxob * Added note to comment on in GitHub. Signed-off-by: carolxob * Update _observing-your-data/alerting/monitors.md Co-authored-by: Melissa Vagi * Edits from doc review incorporated. Signed-off-by: carolxob * Update _observing-your-data/alerting/monitors.md Co-authored-by: Nathan Bower * Trying to commit. Signed-off-by: carolxob * Minor adjustements to commit. Signed-off-by: carolxob * Corrected per query monitor phrasing. Signed-off-by: carolxob --------- Signed-off-by: carolxob Co-authored-by: Melissa Vagi Co-authored-by: Nathan Bower --- _observing-your-data/alerting/monitors.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/_observing-your-data/alerting/monitors.md b/_observing-your-data/alerting/monitors.md index 609bfe73..feaf1f86 100644 --- a/_observing-your-data/alerting/monitors.md +++ b/_observing-your-data/alerting/monitors.md @@ -138,7 +138,12 @@ POST _nodes/reload_secure_settings 1. Specify a name for the monitor. 1. Choose either **Per query monitor**, **Per bucket monitor**, **Per cluster metrics monitor**, or **Per document monitor**. -Per query monitors run your specified query and then check whether the query's results trigger any alerts. Per bucket monitors let you select which fields to create buckets and categorize your results into those buckets. The Alerting plugin runs each bucket's unique results against a script you define later, so you have finer control over which results should trigger alerts. Each of those buckets can trigger an alert, but query-level monitors can only trigger one alert at a time. +OpenSearch supports the following types of monitors: + +- **Per query monitors** run your specified query and then check whether the query's results trigger any alerts. Per query monitors can only trigger one alert at a time. +- **Per bucket monitors** let you create buckets based on selected fields and then categorize your results into those buckets. The Alerting plugin runs each bucket's unique results against a script you define later, so you have finer control over which results should trigger alerts. Furthermore, each bucket can trigger an alert. + +The maximum number of monitors you can create is 1,000. You can change the default maximum number of alerts for your cluster by calling the cluster settings API `plugins.alerting.monitor.max_monitors`. 1. Decide how you want to define your query and triggers. You can use any of the following methods: visual editor, query editor, or anomaly detector.