OK, so you will have to explore more deeply your Alerts page to see if it ever goes from Normal to Pending to Firing. I found that while I would get “Alerting” on the Preview Alerts table (as you do), I was not getting the Alerts page to display “Firing”. I even posted here about it, although the answer provided was not really satisfactory.
I spent more time with this and eventually got it to work for a single parameter (not a multidimensional alert) by removing the time field (but I am using Influx, not Elasticsearch). I plan to post my solution in the coming days when I have some time to do a writeup. In the meantime, try to do a deep explore of your data and try to figure out if there could be any reason(s) for not receiving an alert, even though you received Alerting on the above screen.
I’ve read your post when I add visualization Alert Status and see pending is time <1m
in your post “It is possible that the missing values are causing the alert to return to either OK state, or DatasourceNoData state, both of which will “reset” the pending timer.” maybe because I don’t receive the alert. But last my data is always > 10.
I don’t know why sometime the last data return is 0