Rules in the experimental alerting system

A rule is where the experimental alerting system starts. It points Kibana at the data you care about, describes what counts as a problem in ES|QL, and says how often to check. On each scheduled run, Kibana writes each matching row as a rule event to .rule-events. Those events are never overwritten. Alert episodes (and any notifications) come from events that are grouped into an alert episode.

Use this page to understand what a rule does, why notifications are sent by workflows on action policies rather than on the rule, and to find the right path to create, configure, or manage a rule.

Rules define what to detect. Action policies match alert episodes from any rule and decide whether and when to invoke a workflow. The workflow sends the notification.

This separation means you can update how alert episodes are routed to workflows without touching a rule, and have multiple action policies respond to the same rule independently.

Use these pages to create a rule, change its settings, or manage existing rules.

• Create a rule: Compare creation paths and choose the one that fits your workflow.
• Configure a rule: Set the schedule, grouping, alert delay, recovery condition, and no-data behavior.
• Rule mode: Set whether matches are grouped into an alert episode or remain available for later analysis.
• View and manage rules: Enable, disable, clone, delete, and bulk-manage rules from the Rules page.