This topic describes how to use the open-source Open Distro alarm plugin to configure alarm alerting via the Simple Message Notification (SMN) service for Elasticsearch clusters in Kibana.
By default, CSS installs the open-source Open Distro alarm plugin (opendistro_alerting) for Elasticsearch clusters of versions 7.6.2 and 7.10.2. This plugin has three components: Dashboard, Monitors, and Destinations. You can configure alarm alerting via SMN using the Destinations component. When using the Open Distro alarm plugin, an Elasticsearch cluster needs to send notifications via SMN. This requires service authorization, the purpose of which is to allow CSS to access other cloud resources, such as SMN, through agency, so that alarms generated for Elasticsearch clusters can be sent via SMN notifications. For details about the Open Distro alarm plugin, see Open Distro Monitors.
By default, the open-source Open Distro alarm plugin is installed only in Elasticsearch 7.6.2 and Elasticsearch 7.10.2. Therefore, only these clusters support this feature.
You must log in using a CSS administrator account.
Log in using an account with CSS permissions.
Parameter | Description |
|---|---|
Name | User-defined destination name |
Type | Retain the default value SMN. |
Topic | Select the SMN topic you have created in Prerequisites for sending alarm messages. |
Figure 1 Add destination

Figure 2 Destination list

Parameter | Description |
|---|---|
Monitor name | User-defined monitor name |
Monitor state | Monitoring status. You are advised to keep this function enabled. |
Method of definition | Select a method to define monitoring. You are advised to use Define using extraction query.
|
Index | Index to be monitored |
Time field | When Define using visual graph is selected, select a time field and define counting parameters such as count. |
Frequency | Select the monitoring frequency and set the monitoring interval. The options include:
|
Parameter | Description |
|---|---|
Trigger name | User-defined trigger name |
Severity level | Sensitivity of a trigger, that is, the number of alarms that are triggered before an alarm message is sent. 1 indicates the highest sensitivity. |
Trigger condition | Trigger condition. An alarm is triggered when the trigger condition is hit. |
Action name | Name of a trigger action |
Destination | Select the SMN destination created in section 5. |
Message subject | Title of the alarm message. This parameter is required only when Elasticsearch clusters of version 7.10.2 is used. |
Message | Body of an alarm message. By default, the subject and body are defined when the destination is an email address. |
Action throttling | Message sending frequency. It limits the number of notification messages can be received in a specified period. For example, if this parameter is set to 10 minutes, SMN sends only one alarm notification in the next 10 minutes even if the trigger condition is hit for multiple times. After 10 minutes, SMN sends another alarm notification if the alarm condition is met. |
Figure 3 Setting the destination of a trigger action

Figure 4 Sending test messages

Figure 5 Email notification
