Alerting evaluates fields not defined in query

Grafana Elasticsearch
1

Query:

_exists_:identity_provider AND event_type:LOGIN AND identity_provider:(apple OR facebook OR google)

Setting up alerting on this query gives me alerting on other values than apple/facebook/google.
By using transform i can not use alerting on this panel.

Any other possibilities on narrowing this query?

2

Try this:

event_type:LOGIN AND identity_provider:(apple OR facebook OR google)

Then add
Count:

Group by:
Term : identity_provider - MIn doc: 1

Check the Query Options: MIn interval: 30s

Just use Graph, without Transformation
Then add Alert

3

This did the trick! Thanks!