Understand search capacity and alerting performance

In Elastic Observability Serverless projects, alerting rules can fail or time out, and dashboards can slow down, when too many searches run at once. This applies to rules in both Kibana Classic Alerting and Kibana Universal Alerting, because both systems use the same search capacity.

Elastic Cloud sizes your project's search capacity to its volume of search-ready data, which includes data from the most recent day. Capacity doesn't scale up when query load increases. Searches on recent data are fastest. Older data stays searchable, but queries on it are slower and use more capacity. Ingest runs separately and doesn't compete with search. To learn what counts as search-ready data, refer to Search AI Lake settings.

Everything that queries your project shares the same search capacity, including alerting rules, service-level objectives (SLOs), dashboards, Discover, ES|QL queries, and external clients. These add the most load:

• Many rules, or rules that run often: Every rule run searches your data, so load grows with the number of rules and how often they run.
• Searches over more than the most recent day: Rules with long time windows, and dashboards or Discover sessions with wide time ranges, read older data from general storage. For example, SLO burn rate rules in Kibana Classic Alerting check windows of up to 72 hours by default. In Kibana Universal Alerting, each rule searches its lookback window, or a time range as long as its schedule if you don't set one.
• SLOs: Each SLO continuously queries its source data to keep its status current. By default, a new SLO also backfills up to the last 7 days of data when you create it.

Signs that your project is running out of search capacity include:

• Failed rule runs. For Kibana Classic Alerting rules, look for a Last response of failed in the rules list, or failed runs on the rule's Execution history tab. For Kibana Universal Alerting rules, look for a Response of Failure on the Execution history page.
• Request timed out errors in Kibana.
• Circuit breaker exceptions.
• Slower queries in Discover and on dashboards.

To reduce load:

• Turn off rules you don't need.
• Stagger rule schedules so fewer rules run at the same time.
• Shorten rule time windows and lookbacks where your detection needs allow.
• Narrow the time range on dashboards and in Discover.
• When you create an SLO and don't need its history, select Prevent initial backfill of data in Advanced settings. The SLO then starts from the time you create it.

If you need more search capacity, or want more than the most recent day of data to be search-ready, contact Elastic Support.