Alerting
Elastic alerting helps you watch your data and respond when something needs attention, whether that is a metric crossing a limit, an asset leaving an area on a map, or an unusual pattern in your time series. You set the conditions and how people should be notified. Elastic runs the checks for you.
Kibana alerting gives you ready-made rule types that work with applications such as APM, metrics, security, and uptime monitoring. You set conditions on a schedule you choose and send notifications through common channels (email, chat apps, webhooks, on-call tools, and more). Setup uses forms and clear steps, so you do not need to learn a query language first. It is a strong fit when you want broad coverage out of the box.
Get started with Kibana alerting →
Watcher is for unusual or highly tailored setups where you need scripts, chained steps, or close control over Elasticsearch APIs. It does not use the main Kibana rules UI used by Kibana alerting. It is available on the Elastic Stack only, not in Elastic Cloud Serverless.
For most teams, Kibana alerting or the experimental alerting system is easier to adopt than Watcher. Both work within Kibana's rules UI and don't require writing Elasticsearch watch definitions.