Alerting
Elastic alerting helps you watch your data and respond when something needs attention, whether that is a metric crossing a limit, an asset leaving an area on a map, or an unusual pattern in your time series. You set the conditions and how people should be notified. Elastic runs the checks for you.
Elastic offers three alerting systems. For most new projects and projects on the most recent Kibana versions, the experimental alerting system is the recommended system. If you're not sure which fits your situation, refer to Compare alerting systems.
The experimental alerting system is built on ES|QL. You write the query that defines what to watch for, choose how alert episodes are tracked per series, and control notifications through action policies that handle routing, frequency, and notification batching. The experimental alerting system also adds alert episode lifecycle tracking, per-series snooze, and rules on alert episodes for correlation and escalation. It is a strong fit when you want full control over what data travels with each alert episode and how your team is notified.
The experimental alerting system runs next to Kibana alerting on Elastic Cloud Serverless and Elastic Stack 9.5 and later. You don't have to move everything at once. You can copy or rebuild rules when you're ready, and your existing Kibana alerting rules won't be affected.
Get started with the experimental alerting system →
Kibana alerting gives you ready-made rule types that work with applications such as APM, metrics, security, and uptime monitoring. You set conditions on a schedule you choose and send notifications through common channels (email, chat apps, webhooks, on-call tools, and more). Setup uses forms and clear steps, so you do not need to learn a query language first. It is a strong fit when you want broad coverage out of the box.
Get started with Kibana alerting →
Watcher is for unusual or highly tailored setups where you need scripts, chained steps, or close control over Elasticsearch APIs. It does not use the main Kibana rules UI used by Kibana alerting. It is available on the Elastic Stack only, not in Elastic Cloud Serverless.
For most teams, Kibana alerting or the experimental alerting system is easier to adopt than Watcher. Both work within Kibana's rules UI and don't require writing Elasticsearch watch definitions.