Alerting
Elastic alerting helps you watch your data and respond when something needs attention, whether that is a metric crossing a limit, an asset leaving an area on a map, or an unusual pattern in your time series. You set the conditions and how people should be notified. Elastic runs the checks for you.
Elastic offers three alerting systems. If you're not sure which fits your situation, refer to Compare alerting systems.
You write an ES|QL query that defines what to watch for, decide whether matches are tracked as alerts or recorded as rule events for later analysis, and control notifications through action policies that handle routing, frequency, and notification batching. Kibana Universal Alerting also adds alert lifecycle tracking, per-series snooze, queryable rule event history, and rules that can correlate those events for escalation. It is a strong fit when you want full control over what data travels with each detection and how your team is notified.
Kibana Universal Alerting runs next to Kibana Classic Alerting on Elastic Cloud Serverless and Elastic Stack 9.5 and later. You don't have to move everything at once. You can copy or rebuild rules when you're ready, and your existing Kibana Classic Alerting rules won't be affected.
Get started with Kibana Universal Alerting →
Kibana Classic Alerting gives you ready-made rule types that work with applications such as APM, metrics, and uptime monitoring. You set the conditions and how often to check them, and send notifications through common channels (email, chat apps, webhooks, on-call tools, and more). Setup uses forms and clear steps, so you do not need to learn a query language first. It is a strong fit when you want broad coverage out of the box.
Get started with Kibana Classic Alerting →
Watcher is for unusual or highly tailored setups where you need scripts, chained steps, or close control over Elasticsearch APIs. It does not use the main Kibana rules UI used by Kibana Classic Alerting. It is available on the Elastic Stack only, not in Elastic Cloud Serverless.
For most teams, Kibana Classic Alerting is easier to adopt than Watcher. Both Kibana Classic Alerting and Kibana Universal Alerting work within Kibana's rules UI and don't require writing Elasticsearch watch definitions.