Kibana Universal Alerting overview

Use Kibana Universal Alerting to detect conditions in your Elasticsearch data with ES|QL rules. You can track each problem as an alert from first detection through recovery and route its notifications through reusable action policies, or record matches for later analysis without sending notifications.

Note

Looking for Kibana Classic Alerting? Refer to the Kibana Classic Alerting overview instead. The two systems are separate, so APIs and instructions for one don't apply to the other.

Where to find Kibana Universal Alerting pages in each version
  • Go to Alerting in the Observability navigation menu.
  • Go to Stack Management → Alerting V2 Preview. The UI also calls an alert an alert episode. For example, the Notify per option for one notification per alert is Episode instead of Alert.

In Kibana Universal Alerting, you create and configure rules, action policies, and workflows. Kibana generates the other two building blocks, rule events and alerts, from your rules' matches.

  • Rules: Define what to watch for in your data and how often to check.
  • Rule events: Record each match as a document in .rule-events.
  • Alerts: Track one problem from first detection through recovery, so you triage one lifecycle per problem.
  • Action policies: Decide whether and when to invoke a workflow for an alert. You configure this on the policy, so you can change notifications without changing what each rule detects.
  • Workflows: Send the notification or run the automation, for example posting to Slack, sending an email, or calling a webhook.

A rule evaluates your data on a schedule, and Kibana writes each match as a rule event. The rule's configuration determines the next step:

  • Alert: Kibana groups the event into an alert. An action policy evaluates the alert and can invoke a workflow, which sends the notification or runs the automation.
  • No alert: The event stays in .rule-events for later analysis. You can query it in Discover, build dashboards, or feed it into another rule. These events (type: signal) don't appear on the Alerts page and aren't evaluated by action policies or lifecycle triggers.

For a step-by-step walkthrough of what happens after a rule runs, refer to How it works.

  • Get started: Learn how the system works and its key terms, then create your first rule in a hands-on tutorial.
  • Set up Kibana Universal Alerting: Check the requirements, then turn the system on or off.
  • Manage: Give your team the role privileges it needs, and manage the API keys that authorize rules, action policies, and workflows.
  • Rules: Define what to watch for in ES|QL, and decide which creation path fits your use case.
  • Alerts: Learn how alerts track a problem from first detection through recovery, and how to triage them.
  • Notifications and actions: Learn how action policies decide when to invoke a workflow, and how workflows send the notification.