Set up Kibana Universal Alerting

Check the requirements for Kibana Universal Alerting, turn it on or off for all spaces, and turn on optional features in the spaces where you want them.

You'll need the following to create rules and send notifications.

• Data in Elasticsearch: Rules can only detect conditions in data that already exists. Make sure the indices or data streams your rules will query are populated before creating rules. Refer to Ingest your data for options.
• A space selected: Rules, action policies, and the privileges that control them are all space-scoped. Decide which space you'll work in before setting things up. Refer to Manage spaces to create or switch spaces.
• Connectors configured (required for notifications): Workflows send notifications and require at least one connector, for example, Slack, email, or PagerDuty. Action policies invoke those workflows.
• Enterprise license (Stack deployments only, required for notifications): Workflows-based notifications require an Enterprise license. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for the breakdown of available features and their associated subscription tiers.

Kibana Universal Alerting is controlled by the alerting:v2:enabled advanced setting in Kibana. This is a global setting, so turning it on makes Kibana Universal Alerting available in every space, even though the rules and action policies you create in it are space-scoped.

The setting's default state depends on your version:

• The setting is on by default. If you turned the setting off, it stays off, even after an upgrade.
• The setting is off by default.

To turn on the setting:

1. Go to the Advanced Settings page using the navigation menu or the global search field.

2. Select the Global Settings tab, turn on alerting:v2:enabled, save the change, then refresh the page.

3. Confirm that Kibana Universal Alerting is accessible in your space. Find Rules using the global search field, or go to:

   • Alerting → Rules in the Observability navigation menu
   • Stack Management → Alerting V2 Preview → Rules

To turn off Kibana Universal Alerting, go to the Advanced Settings page, select the Global Settings tab, and turn off alerting:v2:enabled.

Turning off the setting hides the Kibana Universal Alerting UI and turns off its APIs, but it doesn't delete any data. Kibana keeps your rules and action policies as saved objects, along with existing documents in .rule-events and .alert-actions. Turning the setting back on restores the UI and APIs.

Turning off the setting doesn't stop rules and action policies from running. To stop them, use the option for your deployment:

• Contact Elastic support.
• Set xpack.alerting_v2.enabled: false in kibana.yml, then restart Kibana.

To try features of Kibana Universal Alerting that are still experimental, turn on the Universal Alerting: Experimental Features advanced setting (alerting:v2:experimentalFeatures). The setting is off by default and applies only to the space where you turn it on.

When the setting is on, you can:

• Detect multi-step alert patterns by chaining rules into a sequence. On the Rules page, select Build a sequence (Experimental).
• Create rules and action policies by describing them to Elastic Agent Builder in natural language. Select Create rule → Create with agent (Experimental) on the Rules page, or Create policy → Create with agent (Experimental) on the Action Policies page. Elastic Agent Builder has its own requirements.

To turn on experimental features:

1. Switch to the space where you want to use the features.
2. Go to the Advanced Settings page using the navigation menu or the global search field.
3. Select the Space Settings tab, then turn on Universal Alerting: Experimental Features.
4. Select Save changes, then reload Kibana.

When Kibana Universal Alerting is on, an Alerting menu replaces the Observability Alerts link. Its Alerts page lists alerts from both systems, even if you keep the old page.

To keep using the Observability alerts page that lists only alerts from Kibana Classic Alerting rules, turn on the Classic Alerting: Show Classic Alerts table advanced setting (alerting:v1:showV1ObservabilityAlertsTable). The page then appears as Alerts (Classic) in the Alerting menu and in global search results. The setting is off by default and applies only to the space where you turn it on.

To show the Alerts (Classic) page:

1. Switch to the space where you want the page.
2. Go to the Advanced Settings page using the navigation menu or the global search field.
3. Select the Space Settings tab, then turn on Classic Alerting: Show Classic Alerts table.
4. Select Save changes, then reload Kibana.

After you meet the requirements and the system is on:

• Configure access to create or update a role with access to the Kibana Universal Alerting features and the data streams they write to.
• Create your first rule to load sample data, write a detection query, and observe the alert lifecycle.