OK. In order to produce a notable several things must happen. 1. The search must produce results. Have you verified if the search - when run interactively - yields results? 2. The search must be properly dispatched by the scheduler, run to its completion and produce results. Have you verified if the search was dispatched and if/how many results it returned? (you can do this in the normal reports/alerts part of GUI) 3. If the search had been run and produced results which matched the alerting criteria it should have created the entry in the notable index. If I remember correctly this should also be processed by ES internal mechanics and produce entry in kvstore but I don't recall the details here. So there are still quite a few things to debug.
... View more