Create a Kibana Universal Alerting rule from Discover

Convert an ES|QL query you've already built in Discover directly into a Kibana Universal Alerting rule, without rewriting it. Because you test the query against live data in Discover first, you know it returns the shape you expect before the rule is ever saved.

Entry points

Two paths lead to Discover-based rule creation:

  • Discover Alerts menu: When you're in Discover with an active ES|QL query and Kibana Universal Alerting is enabled, the Alerts menu includes a Create ES|QL rule option. The rule creation flyout opens pre-populated with the current query. This path is only available in ES|QL mode.
  • Rules page: To open the Rules page, go to Alerting → Rules in the Observability navigation menu, or find Rules using the global search field. Then select the creation path that opens a flyout with a live Discover session, so you can write and test the query before you save the rule.

When you trigger rule creation from Discover, your ES|QL query pre-fills the Create ES|QL rule form. The rule creation form also shows a preview panel that reflects how your query partitions results into alert series. If your query uses a BY clause, the preview shows the series that would be evaluated on each run, letting you verify grouping logic against live data before committing to a schedule.

The rule creation flyout supports both a step-by-step form and a YAML editor. You can switch between them at any point. Edits are preserved when you return to the form view. The YAML editor includes ES|QL autocomplete in the query field.

For details on configurable rule settings and guidance on how to configure them, refer to Configure a rule.

  • Create a rule: Compare this creation path with the others.
  • ES|QL query patterns: Query examples ranging from a basic event filter to SLO burn rate and persistent breach detection.