Create a rule in the experimental alerting system
The experimental alerting system in Kibana provides several ways to create rules. Compare the options below and pick the one that best fits your workflow and how comfortable you are writing ES|QL.
| Option | Best for |
|---|---|
| Create an ES|QL rule | Full control over the query. Supports both a step-by-step form and a YAML editor. |
| Create using Elastic Agent Builder | When you know what you want to detect but aren't sure how to write the ES|QL. |
| Use the rule builder | Selecting a rule type (currently Threshold Alert) and configuring it through structured inputs, without writing ES|QL by hand. |
| Create from Discover | When you already have an ES|QL query working in Discover and want to convert it into a rule. |