I'm creating a Grafana alert with the Elastic datasource. The condition operator is grouping all meaningful labels from my alert.

[ var='A0' metric='' labels={header_host=hostname1.com value=1496 ], [ var='A1' metric='' labels={header_host=hostname2.com} value=1178 ], [ var='A2' metric='' labels={header_host=hostname3.com} value=764 ], [ var='A3' metric='' labels={header_host=hostname4.com} value=505 ]

Please not that these results are dynamic. Any hostname could become a different hostname.

Since I can't/don't know how to make a unique alert for each result, I'm trying to range over the value string listed there.

{{ range .ValueString}}<strong>{{$labels.header_host}}</strong>:  {{ $value }}{{ end }}

This does not range at all.

Is it possible to break these alerts up/range over the value string of the grafana alert?

To my knowledge, I can't limit the occurrences in elasticsearch

CodePudding user response：

Remove Classic condition and use Math operation with expression $A>500. That will create multidimensional alert (based on header_host label) - each returned timeseries will be executed against this expression. See Preview alerts.