Rules in the experimental alerting system
A rule is where the experimental alerting system starts. It points Kibana at the data you care about, describes what counts as a problem in ES|QL, and says how often to check. Alerts, action policies, and notifications all flow from what a rule detects.
This page explains what rules do, what they don't control, and how to choose a creation path.
On each run, a rule executes an ES|QL query against your data. Matches are recorded as rule events (rule_event), and handled according to the rule's mode, which can be Signal mode or Alert mode.
In Signal mode, each matching row is stored as a signal document with no alert lifecycle or notifications. In Alert mode, the rule creates and tracks an alert episode for each match. Episodes move through lifecycle states and can trigger notifications through action policies. Go to Alerting V2 Preview in the navigation menu or global search, then go to Alerts to view them.
Rules only define what to detect. They don't control notifications, who gets notified, or when. That's the job of action policies, which are global objects scoped to your space that match alert episodes from any rule. A rule has no say in which action policies pick it up.
This separation means you can build and test a rule without anyone getting paged, update notification routing without touching the rule, and have multiple action policies respond to the same rule independently.
From here, you can create, configure, and manage rules, and review what they've detected.
- Create a rule: Compare creation paths and choose the one that fits your workflow.
- Configure a rule: Set the schedule, grouping, alert delay, recovery condition, and no-data behavior.
- View and manage rules: Enable, disable, clone, delete, and bulk-manage rules from the Rules page.
- Review rule execution history: Monitor rule execution outcomes across all rules in a space.
- ES|QL query patterns: Browse query patterns ordered by complexity, from a basic event filter to SLO burn rate and persistent breach detection.
- Rule events: Understand the documents rules write to
.rule-events.
Because the experimental alerting system is still evolving, its UI can change before general availability. Rather than pointing to an exact button or menu, the documentation focuses on the underlying concepts and behavior. If something doesn't match what you see in the Kibana UI, look for the closest equivalent instead. The concepts and behaviors described in the documentation still apply.