Alert not correctly detecting my trigger

Alert configuration

Query Inspector

Testing rule

  "firing": true,
  "state": "pending",
  "conditionEvals": "true = true",
  "timeMs": "162.778ms",
  "matches": [
      "metric": "Count",
      "value": 0


Hi alejogomezomil, what do you expect that alert return you? I mean your goal in this case is to get the last number of your query below from 1?

Thanks for answer quickly.
I expect the alert to return a green status (because the service is currently active) and not a Pending State.

I understand, you expect a OK status, that means that your condition won’t be fulfill, am I right?

It is right.
The condition isnt fullfil and the expected state should be OK.

It is as if the condition “BELOW of 1” includes the 1 (is not an exclusive rule), so the trigger is TRUE and shows a PENDING status that is not the expected.

Maybe you should use Count() instead last().

Sory for the delay.

I tried with count() instead last(), but the result is the inverse.
The status is OK, when the service is down really.
Summary: OK always appears

with this configuration

What I tried to do is.
If query return “1” (service up), show an OK status.
If query return “0” (servide down), show an ALERTING status.

This is the data collection that I receive.

The behavior expected is an ALERTING status.
But, if I use count () instead of last (), the behavior I get is a OK status as I show in the answer above.

I see, I don’t know which is the best function for what you are trying to do. Hovewer I’ll try to look for something about your issue.

I solved it.
I setted the trigger in

when last() ABOVE 0

and also I changed the lucene query to bring me only when the monitor.status is down.
So then the alert works when detect one or more down times. (in the solution that I tried before, the alert worked when the monitor.status was less than 1)

Here is the solution: