Review rule change history in Kibana Universal Alerting

A rule's change history shows who changed the rule, when, and exactly which settings changed. Kibana saves a new version of a rule each time someone creates, edits, enables, or disables it.

Use the change history to:

  • Find out whether a recent edit explains why a rule started alerting more, alerting less, or stopped running.
  • See who enabled or disabled a rule.
  • Look up a rule's earlier settings before you change them back.

To check whether a rule's runs succeeded, rather than how its settings changed, use rule execution history.

Select View change history from any of these places:

  • The rule's actions menu on the Rules page
  • The Take action menu in the rule summary flyout
  • The actions menu on the rule's details page

The change history opens on the newest version, so you see the most recent change first. Anyone who can view a rule can open its change history, even without permission to edit the rule.

The change history lists the rule's versions, newest first. Each entry shows who made the change, when they made it, and the kind of change, which is one of rule_create, rule_update, rule_enable, or rule_disable. A Current version badge marks the version the rule uses now.

Kibana records every change, including bulk actions on the Rules page and changes made through the API.

If the change history is empty, the rule hasn't changed since change history became available. Kibana doesn't record changes made before then.

Select a version to see what it changed. Kibana compares it with the version before it and shows the difference as a JSON diff of the rule's configuration, with added and removed lines highlighted.

The oldest version has no earlier version to compare with, so selecting it shows the rule's full configuration at that point.

To see everything that changed across several edits, compare two versions directly:

  1. Select the newer version. To compare with the rule's current settings, select the version marked Current version.
  2. On the older version, select Version actions → Compare to this version.

The diff uses the older version as its starting point, so added lines show what the newer version introduced.

Change history is read-only, so you can't restore an earlier version from it. To undo a change:

  1. Compare the current version with the version you want to go back to.
  2. Edit the rule and set each changed field back to its earlier value.