Create a rule using the rule builder in the experimental alerting system
The rule builder lets you create a rule by selecting a rule type and configuring it through structured inputs, instead of writing ES|QL directly. Behind the scenes, the rule builder generates the ES|QL query for you from the data source, aggregation, filters, and alert conditions you set.
To create a rule, go to Alerting V2 Preview in the navigation menu or global search, then go to Rules. When choosing a creation path, select the one in the rule builder section.
The rule builder differs from the Rule form described in Create an ES|QL rule. The Rule form is for writing an ES|QL query directly, with a live preview of results. The rule builder instead has you select a rule type, then fills in the query for you based on the structured inputs you provide for that type.
Threshold Alert is the only rule type available in the rule builder. Use it to monitor metrics against one or more threshold conditions. Custom aggregations let you control how metric values are computed before they are compared to the threshold.
- Create a rule: Compare this creation path with the others.
- Configure a rule: All configurable rule settings, required and optional.