View and manage alerts in Kibana Universal Alerting

In Kibana Universal Alerting, use the Alerts page to monitor alerts with KPI panels, a histogram, and filters. To open it, go to Alerting → Alerts in the Observability navigation menu, or find Alerts using the global search field.

The page also lists alerts from Kibana Classic Alerting rules, so you can monitor and triage alerts from both systems in one table. Refer to View alerts from both alerting systems.

To silence, close, or tag alerts, refer to Triage alerts. For alert lifecycle history, related alerts, and assignment, refer to Investigate alerts.

Alerts belong to the current Kibana space, and the alerting pages list only that space's alerts. If you have access to several spaces, or direct access to the underlying alert indices, you can see alerts from other spaces, for example in Discover.

The Alerts page includes two summary panels:

  • KPI panels: Show aggregate alert counts for the current filter state and time range. Use them to understand the scale of a situation before reviewing individual alerts.
  • Histogram: Shows the total number of alerts that existed within each time interval. A long-lived alert counts in every interval it was open, not only the one it started in. Brush the chart to update the time filter. You can break down the chart by status, rule, acknowledgment, or assignee.
Note

The histogram queries up to 10,000 alerts for each time range. Narrow the time range or add filters if you exceed this limit.

Use the following controls on the Alerts page to narrow the alert list:

  • Rule: Limit to one or more rules.
  • Status: Limit by lifecycle state (inactive, pending, active, recovering).
  • Severity: Limit to one or more severity levels.
  • Alert tags or Tags (depending on your Elastic Stack version): Limit to alerts matching any selected tag. Tag choices come from the tags on alerts in the selected time range.
  • Assignee: Limit to alerts assigned to one or more users.
  • Search: Text search over alert event document fields.
Tip

Narrow the time range when filters return too many results or tag options need refreshing.

To tell alerts from the two systems apart, check the Source column: Universal for Kibana Universal Alerting or Classic for Kibana Classic Alerting. To act on Kibana Classic Alerting alerts from the Alerts page, refer to Triage alerts from Kibana Classic Alerting.

You see a Kibana Classic Alerting alert only if your role can view alerts from its rule type. For the privileges, refer to Configure access.

The table includes Kibana Classic Alerting alerts from these rule types:

  • Observability rules: APM, Synthetics, Uptime, Metric threshold, Inventory, Log threshold, SLO burn rate, and Custom threshold
  • Stack rules: Elasticsearch query, Index threshold, Tracking containment, Transform health, and Anomaly detection

Kibana Classic Alerting alerts appear in the KPI panels, histogram, and filters like any other alert, with these differences:

  • They use only the Active and Inactive statuses. A recovered or untracked alert shows as Inactive.
  • They can have the Warning, Minor, and Major severity levels, and can show the Flapping icon in the Status column.
  • You can't assign them, so the Assignee filter doesn't apply to them and the KPI panels count them as unassigned.
  • A search matches each alert's own fields. For example, a query on kibana.alert.rule.name matches Kibana Classic Alerting alerts but not Kibana Universal Alerting alerts.