Inventory Alerting - More than 1 alerts for same hosts

[erikg]

Hello,

I am on Kibana/ES: v8.18.0
It appears that I created a memory usage Inventory alert.

It works as expected until I notice 2 alerts pop up for the same host:

Shouldn't it be one alert and until that recovers then alert a new one?
The alert frequency is set as "on status changes", it appears it creates a new alert for "Flapping"

[Tortoise]

Hello @erikg

Why Does an Active Alert Still Exist While Flapping?

1. Flapping is a Meta-State, Not a Replacement for Active

• When an alert is flapping, Kibana does not immediately recover the Active alert.
• Instead, it marks the alert as flapping because it keeps switching between Active and Recovered within a defined threshold.

2. Flapping Detection Works Separately from Active Status

• Kibana tracks how often an alert changes state. If it meets the flapping criteria (e.g., switching 6 times in 10 runs), it gets an additional Flapping status.
• However, if the condition that originally triggered the Active alert is still met, the alert remains Active.

3. New Alert Entry for Flapping

• Kibana sometimes creates a separate alert entry for flapping detection instead of modifying the original alert.
• This happens because flapping is an alert behavior, not a direct status change.

Thanks!!

[erikg]

@Tortoise thanks for the clarification.

I think regardless of the flapping condition, the inventory rule (for memory) is generating duplicates:

Above screenshot shows two active alerts coming from the same host, there should only be one if the initial alert has and is active.