Loading

Create a rule from Discover in the experimental alerting system

Convert an ES|QL query you've already built in Discover directly into a rule, without rewriting it. Because you test the query against live data in Discover first, you know it returns the shape you expect before the rule is ever saved.

Entry points

Two paths lead to Discover-based rule creation:

  • Discover Alerts menu: When you're in Discover with an active ES|QL query and the experimental alerting system is enabled, the Alerts menu includes a Create ES|QL rule option. The rule creation flyout opens pre-populated with the current query. This path is only available in ES|QL mode.
  • Rules page: To create a rule, go to Alerting V2 Preview in the navigation menu or global search, then go to Rules. When choosing a creation path, select the one that opens a flyout embedding a live Discover session, so you can compose and test the query before saving the rule.

When you trigger rule creation from Discover, your ES|QL query pre-fills the Create ES|QL rule form. The rule creation form also shows a preview panel that reflects how your query partitions results into alert series. If your query uses a BY clause, the preview shows the series that would be evaluated on each run, letting you verify grouping logic against live data before committing to a schedule.

The rule creation flyout supports both a step-by-step form and a YAML editor. You can switch between them at any point. Edits are preserved when you return to the form view. The YAML editor includes ES|QL autocomplete in the query field.

For details on configurable rule settings and guidance on how to configure them, refer to Configure a rule.

  • Create a rule: Compare this creation path with the others.
  • ES|QL query patterns: Query examples ranging from a basic event filter to SLO burn rate and persistent breach detection.