Alerting set upedit

Kibana alerting features are automatically enabled, but might require some additional configuration.


If you are using an on-premises Elastic Stack deployment:

If you are using an on-premises Elastic Stack deployment with security:

The alerting framework uses queries that require the search.allow_expensive_queries setting to be true. See the scripts documentation.

Production considerations and scaling guidanceedit

When relying on alerting and actions as mission critical services, make sure you follow the alerting production considerations.

For more information on the scalability of alerting features, go to Scaling guidance.


If you want to use the alerting features in a Kibana app, you must have the appropriate feature privileges. For example, to create rules in Discover or Stack Management > Rules, you must have all privileges for the Management > Stack Rules feature. To add rule actions and test connectors, you must also have read privileges for the Actions and Connectors feature. To change rule settings, you must have all privileges for the Rules Settings privilege or all privileges for the appropriate sub-feature such as flapping detection. For more information on configuring roles that provide access to features, go to Feature privileges.

Each rule also has a rule visibility value (or consumer in the APIs), which affects the Kibana feature privileges that are required to access it. To view or edit a rule that has a Stack Rules rule visibility, for example, you must have the appropriate Management > Stack Rules feature privileges.

For details about the prerequisites required to run each API, refer to Alerting APIs.

API keysedit

Rules are authorized using an API key. Its credentials are used to run all background tasks associated with the rule, including condition checks like Elasticsearch queries and triggered actions.

If you create or edit a rule in Kibana, an API key is created that captures a snapshot of your privileges at the time of the edit. The following actions regenerate the API key in Kibana:

  • Creating a rule
  • Updating a rule

When you disable a rule, it retains the associated API key which is reused when the rule is enabled. If the API key is missing when you enable the rule (for example, in the case of imported rules), it generates a new key that has your security privileges.

You can update an API key manually in Stack Management > Rules or in the rule details page by selecting Update API key in the actions menu.

If you manage your rules by using Kibana APIs, they support support both key- and token-based authentication as described in Authentication. To use key-based authentication, create API keys and use them in the header of your API calls as described in API Keys. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently associated with the rule and used when it runs.

If a rule requires certain privileges, such as index privileges, to run and a user without those privileges updates the rule, the rule will no longer function. Conversely, if a user with greater or administrator privileges modifies the rule, it will begin running with increased privileges. The same behavior occurs when you change the API key in the header of your API calls.

Restrict actionsedit

For security reasons you may wish to limit the extent to which Kibana can connect to external services. You can use Action settings to disable certain Connectors and allowlist the hostnames that Kibana can connect with.

Space isolationedit

Rules and connectors are isolated to the Kibana space in which they were created. A rule or connector created in one space will not be visible in another.

Cross-cluster searchedit

If you want to use alerting rules with cross-cluster search, you must configure privileges for CCS and Kibana. Refer to Remote clusters.