I am trying to make a rule that will only send me alerts when my device is not responding AND ping to 8.8.8.8 will respond.
In a situation where 8.8.8.8 is not responding AND the monitored device is also not responding, the alert is not to be sent.
1604 is the id of the “device” with address 8.8.8.8, set as ping only.
Make your 8.8.8.8 device a parent of the actual device. If that doesn’t work for your use case, you’d probably be looking at writing an advanced/SQL query alert.
The problem that you’re running into here is that alerts are processed while each device is being polled. There’s an implied WHERE device_id == ? built into these rules, and ? is the ID of the device currently being polled. So for the lower group in your alert, you’re not checking the status of device 1604, you’re checking to see if the ID of the device currently being polled is 1604 and you’re not checking that 1604 is down, you’re doing a second check of the status of the device currently being polled.