From 136fe4432516f40300a2cb636c492ed49cef5f03 Mon Sep 17 00:00:00 2001
From: enesyalinkaya <49714068+enesyalinkaya@users.noreply.github.com>
Date: Mon, 6 May 2024 00:28:23 +0300
Subject: [PATCH] add new alerts for elasticsearch rules.yml

This commit adds new Prometheus alert definitions to monitor indexing and query metrics in Elasticsearch clusters. These alerts are essential for detecting performance issues related to indexing and querying activities.
---
 _data/rules.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/_data/rules.yml b/_data/rules.yml
index 109b0c8..744bf10 100644
--- a/_data/rules.yml
+++ b/_data/rules.yml
@@ -1128,6 +1128,26 @@ groups:
                 description: No new documents for 10 min!
                 query: 'increase(elasticsearch_indices_indexing_index_total{es_data_node="true"}[10m]) < 1'
                 severity: warning
+              - name: Elasticsearch High Indexing Latency
+                description: "The indexing latency on Elasticsearch cluster is higher than the threshold."
+                query: "elasticsearch_indices_indexing_index_time_seconds_total / elasticsearch_indices_indexing_index_total > 0.0005"
+                severity: warning
+                for: 10m       
+              - name: Elasticsearch High Indexing Rate
+                description: "The indexing rate on Elasticsearch cluster is higher than the threshold."
+                query: "elasticsearch_indices_indexing_index_total > 100000"
+                severity: warning
+                for: 5m     
+              - name: Elasticsearch High Query Rate
+                description: "The query rate on Elasticsearch cluster is higher than the threshold."
+                query: "elasticsearch_indices_search_query_total > 100000"
+                severity: warning
+                for: 5m
+              - name: Elasticsearch High Query Latency
+                description: "The query latency on Elasticsearch cluster is higher than the threshold."
+                query: "elasticsearch_indices_search_fetch_time_seconds / elasticsearch_indices_search_fetch_total > 1"
+                severity: warning
+                for: 5m                 
 
       - name: Cassandra
         exporters: