# Ingest manager and Kibana alerting 7.8.1 **URL:** \ **Category:** Feature Requests\ **Created:** [August 4, 2020, 5:29pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912 "2020-08-04T17:29:03Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [August 4, 2020, 5:29pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/1 "2020-08-04T17:29:03Z")
Ingest manager (beta) was introduced in 7.8.0 - [Fleet | Kibana Guide [8.4] | Elastic](https://www.elastic.co/guide/en/kibana/current/ingest-manager.html) But this required ES Security to be enabled. ![image](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/b47ad777a75d5ff6ec5ad2a732f7ad6cb1f8c9c8.png) Can SG work, in conjunction with ES Security enabled? else I am not 100% sure how we can use this new feature of ingest manager with SG ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [August 5, 2020, 5:51pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/2 "2020-08-05T17:51:44Z")
Currently, SearchGuard supports only the following X-Pack apps: - Monitoring - Alerting - Machine Learning > **[X-Pack Monitoring](https://docs.search-guard.com/latest/search-guard-xpack-monitoring)** > > How to configure Search Guard to integrate with the free X-Pack Monitoring for Elasticsearch The ingest manager is a new experimental X-Pack app. We will look into it to see whether support can be introduced. ---
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [August 12, 2020, 4:44pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/3 "2020-08-12T16:44:07Z")
Does SG support [Alerting | Kibana Guide [7.16] | Elastic](https://www.elastic.co/guide/en/kibana/7.x/alerting-getting-started.html) As, when I try this I get error - “Unable to load alert state:” ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [August 13, 2020, 2:03pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/4 "2020-08-13T14:03:09Z")
I haven’t tried this. Looking at [prerequisites](https://www.elastic.co/guide/en/kibana/7.8/alerting-getting-started.html#alerting-setup-prerequisites), I would say it should work. Btw, Search Guard has a built-in alerting system - Signals. Here are some docs and video: [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/c/cfeff81e420de329da264cbd69eef953c7d07b33.jpeg "Signals - Alerting for Elasticsearch") ](https://www.youtube.com/watch?v=Big_niMxQJ4) > **[Alerting for Elasticsearch | Search Guard | Signals](https://search-guard.com/signals-elasticsearch-alerting/)** > > Signals provides free enterprise alerting features for Elasticsearch and is fully compatible with all Search Guard security features. > **[Getting started with Signals Alerting](https://docs.search-guard.com/latest/elasticsearch-alerting-getting-started)** > > How to get started with Signals Alerting for Elasticsearch to find anomalies in your data and send alerts ---
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [August 13, 2020, 2:51pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/5 "2020-08-13T14:51:39Z")
Yes, I was going to create Index alerting from ES/Kibana alerts and actions. And then use SG’s Alerting app to fire those alerts to Slack/pagerduty etc. ---
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [August 13, 2020, 9:50pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/8 "2020-08-13T21:50:36Z")
Was able to see this error {“type”:“log”,“@timestamp”:“2020-08-13T20:07:05Z”,“tags”:[“error”,“plugins”,“alerting”,“plugins”,“alerting”],“pid”:8,“message”:“enable(): Failed to load API key to invalidate on alert a7c15802-3c04-452d-b836-2efde02c09ae: Saved object [alert/a7c15802-3c04-452d-b836-2efde02c09ae] not found”} Do, we need to add rules/roles in SG to allow creation of Saved Objects alert/\<\> ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [August 14, 2020, 11:42am UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/9 "2020-08-14T11:42:21Z")
The Elastic Kibana Alerting and the Search Guard Signals Alerting are two completely separate applications. Signals is an Elasticsearch plugin that runs watches inside your ES cluster, similar to Elastic Watcher. The Kibana Alerting from Elasticsearch runs completely in Kibana. So the two apps are not compatible with each other. ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [August 14, 2020, 1:24pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/10 "2020-08-14T13:24:44Z")
@sc75651 I see Kibana alerting supports [Webhook and Index actions](https://www.elastic.co/guide/en/kibana/7.x/action-types.html). You can integrate Signals and Kibana alerting using one of this actions. For example 1. Setup a Kibana alert to index docs when triggered. 2. Setup a Signals watch to periodically search for the documents in the Kibana alert index and do one of the available actions. > “type”:“log”,“@timestamp”:“2020-08-13T20:07:05Z”,“tags”:[“error”,“plugins”,“alerting”,“plugins”,“alerting”],“pid”:8,“message”:“enable(): Failed to load API key to invalidate on alert a7c15802-3c04-452d-b836-2efde02c09ae: Saved object [alert/a7c15802-3c04-452d-b836-2efde02c09ae] not found”} > Do, we need to add rules/roles in SG to allow creation of Saved Objects alert/\<\> See if you have any other errors in the Elasticsearch log. Usually, there is a hint for the required permission. ---
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [August 14, 2020, 4:27pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/11 "2020-08-14T16:27:56Z")
> [@srgbnd](#): > > 2020-08-13T20:07 Thanks for quick reply, yes we are trying to do same thing… hard luck finding any errors in ES, but only Kibana throws errors mentioned above, hence seem it is UI based as Kibana alerts are originated and executed by them and not ES We tested with ELK Stack without SG and above Example - Step 1 works, seems After adding SG to mix some permissions are not allowing the Alert to be fired. Observation from ELK (Without SG and Security) 1 - Alert Created 2 - Attached Actions 3 - Enabled Alert (and this went active) So, seems SG might be blocking `https://kibana/api/alert/61409c90-dda8-11ea-830e-332c8e77d0a1` from execution… We get 404, on the page where the alert is `{statusCode: 404, error: "Not Found",…} error: "Not Found" message: "Saved object [task/61409c90-dda8-11ea-830e-332c8e77d0a1] not found" statusCode: 404` Just to confirm we have SGS\_ALL\_ACCESS for our tenant, Any help is appreciated ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [August 17, 2020, 8:58am UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/12 "2020-08-17T08:58:34Z")
Ok. I added this to the queue to reproduce. I’ll reach you back when I have more information. ---
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [August 18, 2020, 6:15pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/13 "2020-08-18T18:15:20Z")
Thank you, do you have ticket which I can follow for updates. ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [August 19, 2020, 11:10am UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/14 "2020-08-19T11:10:37Z")
@sc75651 we use Jira to track issues (tickets). And we provide access for the enterprise users. If you have the license but doesn’t have access yet, please contact us here [Contact the Search Guard team - get in touch with us](https://search-guard.com/contacts/) ---
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [September 5, 2020, 11:05am UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/15 "2020-09-05T11:05:42Z")
Is this fixed in latest SG release? ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [September 7, 2020, 1:01pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/16 "2020-09-07T13:01:31Z")
Kibana alerting requires to set [API keys](https://www.elastic.co/guide/en/kibana/7.9/api-keys.html) (impersonation). The debug log warns about this. ```auto kibana.example.com | {"type":"log","@timestamp":"2020-09-07T12:45:59Z","tags":["debug","plugins","encryptedSavedObjects"],"pid":7,"message":"The following attributes of saved object \"alert,8abf443b-8953-4b61-a874-fd40ec72b107\" should have been decrypted: apiKey, but found only: "} ``` Also, it is stated in the documentation. > Kibana alerting uses [API keys](https://www.elastic.co/guide/en/kibana/7.9/api-keys.html) to secure background alert checks and actions, and API keys require [TLS on the HTTP interface](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/configuring-tls.html#tls-http). > **[Alerting | Kibana Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/kibana/7.9/alerting-getting-started.html#alerting-setup-prerequisites)** And API keys are available only if XPack security is enabled, which we don’t support. Thus we can’t support the Kibana alerting right now. ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [September 7, 2020, 1:36pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/17 "2020-09-07T13:36:32Z")
Again, I think you can do all things you want with our Signals alert. You just need to know how to use Elasticsearch DSL to search for the data. Or use the graph mode if you need simple alerts. Here, look at some videos and the documentation [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/f/fb60e55f6ea2862301810e38a1d39c0ae543aabd.jpeg "Signals Alerting for Elasticsearch: Creating a simple alert") ](https://www.youtube.com/watch?v=Wqk0m8ibNnM) [![](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/23271cef03f9e987f612c93db9a0af89132bb596.jpeg "Creating Elasticsearch Watches using the Signals Blocks Mode") ](https://www.youtube.com/watch?v=lQNauVac8tw) > **[Getting started with Signals Alerting](https://docs.search-guard.com/latest/elasticsearch-alerting-getting-started)** > > How to get started with Signals Alerting for Elasticsearch to find anomalies in your data and send alerts ---
**Author:** ![sc75651](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/sc75651/32/782_2.png) [@sc75651](https://forum.search-guard.com/u/sc75651)\ **Post date:** [November 13, 2020, 3:46pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/18 "2020-11-13T15:46:10Z")
Does the latest 7.9.3 release support this now, as you have added [Search Guard Auth Tokens | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/search-guard-auth-tokens) ---
**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\ **Post date:** [November 13, 2020, 4:37pm UTC](https://forum.search-guard.com/t/ingest-manager-and-kibana-alerting-7-8-1/1912/19 "2020-11-13T16:37:54Z")
Hi. No, this feature is not related. Kibana alerting requires to set Kibana API keys. Which is part of the XPack security. And we don’t support it.