Significant Events

Significant Events continuously converts raw log data into a ranked feed of incidents. The pipeline moves from broad to narrow. Many alerts fire, an AI agent narrows these down into findings, and the most important ones are surfaced as significant events.

For example, you onboard a stream, Significant Events extracts what's in it ("this stream contains a Python gRPC service called recommendationservice running on GKE"), generates targeted detection rules ("detect gRPC connection failures"), and runs those rules continuously. Results flow through discovery and surface as correlated significant events across your entire environment.

Elastic nightshift and Significant Events require an Elastic Observability Serverless project on the Complete tier.

Significant Events uses the Elastic Inference Service (EIS) for large language model (LLM) calls. You don't need to configure an LLM connector or select a model.

The pipeline runs in sequential phases that build on the output of the previous phase. Knowledge Indicator (KI) extraction and rule generation prepare your streams for detection and run on your schedule. Detection and discovery run continuously in the background after you enable Significant Events.

An LLM analyzes log samples from your streams and extracts services, infrastructure, dependencies, and failure patterns as Knowledge Indicators (KIs). Deterministic generators run in parallel to produce dataset statistics, log patterns, and error samples.

An LLM converts KIs into ES|QL alerting rules scoped to the services and failure modes present in each stream. Generated rules are saved as stream assets. Lower-severity rules stay unbacked until you review and promote them; high-severity detections are promoted automatically and begin running right away.

Promoted rules execute on a specified schedule against stream logs and record a count of matches per time bucket to the .rule-events index. A Detection workflow runs change point aggregation against those per-rule counts and writes a detection record whenever the aggregation finds a statistically significant shift.

The Discovery agent reads detection records, correlates signals across rules and streams, verifies its own findings, and sets each event's status to open, closed, or dismissed. Significant events are also written as alerts, so you can manage and route them like any other Elastic alert.

Refer to the following pages for more information on Significant Events: