Loading

Review action policy execution history in the experimental alerting system

Action policy execution history shows dispatcher decisions from the last 24 hours across all action policies in the space, so you can confirm notifications are dispatching as expected or investigate unexpected notification behavior.

Go to Execution history in the navigation menu or global search, then select the Policies tab. Each row covers one dispatcher run for each action policy evaluated against a rule:

Column Description
Timestamp When the dispatcher ran.
Policy The action policy that was evaluated.
Outcome Whether the dispatcher acted on the episode: dispatched, throttled, or unmatched. Definitions are in Dispatch outcomes.
Rules The rule whose alert episodes the action policy processed.
Episodes The number of alert episodes processed in this run.
Action groups The number of action groups involved.
Workflows The workflows invoked, if any.

You can search records by action policy name, rule name, or saved-object ID, and filter by outcome to view only dispatched or throttled records.

After each dispatcher run, Kibana records one of three outcomes for each action policy:

Outcome What it means
dispatched The dispatcher invoked a workflow for the alert episode.
throttled The alert episode matched an action policy but was rate-limited by the frequency setting, so no workflow ran. This is expected behavior, not an error.
unmatched No action policy matched the alert episode. No workflow ran.

unmatched is recorded in the event log but isn't available as an outcome filter in the execution history. To find those records, open Discover and query .kibana-event-log-* with event.provider: "alerting_v2" and event.action: "unmatched".

Note

Episodes that are acknowledged, snoozed, marked inactive, or covered by a maintenance window are excluded before the dispatcher runs and don't appear in the execution history.