---
title: Create a synthetic monitor status rule
description: Within the Synthetics UI, create a Monitor Status rule to receive notifications based on errors and outages. To access this page, go to Synthetics → Overview.At...
url: https://www.elastic.co/elastic/docs-builder/docs/3028/solutions/observability/incident-management/create-monitor-status-rule
products:
- Elastic Cloud Serverless
- Elastic Observability
---
# Create a synthetic monitor status rule
Within the Synthetics UI, create a **Monitor Status** rule to receive notifications based on errors and outages.
1. To access this page, go to **Synthetics** → **Overview**.
2. At the top of the page, click **Alerts** → **Monitor status rule** → **Create status rule**.
## Filters
The **Filter by** section controls the scope of the rule. The rule will only check monitors that match the filters defined in this section. In this example, the rule will only alert on `browser` monitors located in `Asia/Pacific - Japan`.
## Conditions
Conditions for each rule will be applied to all monitors that match the filters in the [**Filter by** section](#observability-monitor-status-alert-filters). You can choose the number of times the monitor has to be down relative to either a number of checks run or a time range in which checks were run, and the minimum number of locations the monitor must be down in.
Retests are included in the number of checks.
Elastic Stack: Generally available since 9.1 **Alert on no data** (optional): Enable this option to receive alerts when a monitor is in a **pending** state—that is, when no ping data has been received from the monitor for the evaluation period. This helps you detect monitors that have stopped reporting (for example, due to a misconfiguration, runner failure, or network issue). When this option is enabled:
- **Pending state**: A monitor is considered pending when no check results (pings) have been received within the rule's evaluation window. The alert reason follows the format: `Monitor "X" from Location Y is pending.`
- **Recovery**: The alert recovers automatically once the monitor reports data again, whether the result is up or down. No separate recovery action is required.
- **Action variables**: For pending-state alerts, the same [action variables](#observability-monitor-status-alert-action-variables) are available (such as `context.monitorName`, `context.monitorId`, `context.locationName`, `context.monitorUrl`, and `context.reason`). The `context.reason` and `context.message` fields reflect the pending status and monitor/location details.
The **Rule schedule** defines how often to evaluate the condition. Note that checks are queued, and they run as close to the defined value as capacity allows. For example, if a check is scheduled to run every 2 minutes, but the check takes longer than 2 minutes to run, a check will not run until the previous check has finished.
In this example, the conditions will be met any time a `browser` monitor is down `3` of the last `5` times the monitor ran across any locations that match the filter. These conditions will be evaluated every minute, and you will only receive an alert when the conditions are met three times consecutively.
You can also set **Advanced options** such as:
- **Alert delay**: The number of consecutive runs that must meet the rule conditions before an alert occurs.
- Elastic Stack: Generally available since 9.1 **Alert flapping detection**: Detect alerts that switch quickly between active and recovered states and reduce unwanted noise for these flapping alerts.
You can also customize the configuration through the following settings:
- **Rule run look back window**: The minimum number of runs in which the threshold must be met.
- **Alert status change threshold**: The minimum number of times an alert must switch states in the look-back window.
## Action types
Extend your rules by connecting them to actions that use the following supported built-in integrations.
- [Cases](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/cases-action-type)
- [D3 Security](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/d3security-action-type)
- [Email](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/email-action-type)
- [IBM Resilient](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/resilient-action-type)
- [Index](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/index-action-type)
- [Jira](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/jira-action-type)
- [Microsoft Teams](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/teams-action-type)
- [Observability AI Assistant](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/obs-ai-assistant-action-type)
- [Opsgenie](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/opsgenie-action-type)
- [PagerDuty](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/pagerduty-action-type)
- [Server log](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/server-log-action-type)
- [ServiceNow ITOM](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/servicenow-itom-action-type)
- [ServiceNow ITSM](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/servicenow-action-type)
- [ServiceNow SecOps](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/servicenow-sir-action-type)
- [Slack](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/slack-action-type)
- [Swimlane](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/swimlane-action-type)
- [Torq](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/torq-action-type)
- [Webhook](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/webhook-action-type)
- [xMatters](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/reference/kibana/connectors-kibana/xmatters-action-type)
Some connector types are paid commercial features, while others are free. For a comparison of the Elastic subscription levels, go to [the subscription page](https://www.elastic.co/subscriptions).
After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour:
Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: the *Synthetics monitor status* changes or when it is *Recovered* (went from down to up).
You can also further refine the conditions under which actions run by specifying that actions only run when they match a KQL query or when an alert occurs within a specific time frame:
- **If alert matches query**: Enter a KQL query that defines field-value pairs or query conditions that must be met for notifications to send. The query only searches alert documents in the indices specified for the rule.
- **If alert is generated during timeframe**: Set timeframe details. Notifications are only sent if alerts are generated within the timeframe you define.
#### Action variables
Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables.
Elastic Stack: Generally available since 9.1 When **Alert on no data** is enabled and an alert fires for a pending monitor (no data received), the alert document includes monitor and location details (such as monitor name, ID, type, location, tags, URL, and error when applicable). These are available through the same context variables listed below; `context.reason` for a pending alert uses the format: `Monitor "X" from Location Y is pending.`
The following variables are specific to this rule type. You can also specify [variables common to all rules](https://www.elastic.co/elastic/docs-builder/docs/3028/explore-analyze/alerting/alerts/rule-action-variables).
Timestamp of the monitor run.
Hostname of the location from which the check is performed.
Monitor last error message.
Location id from which the check is performed.
Location name from which the check is performed.
Location names from which the checks are performed.
A generated message summarizing the status of monitors currently down.
ID of the monitor.
Name of the monitor.
Tags associated with the monitor.
Type (for example, HTTP/TCP) of the monitor.
URL of the monitor.
A concise description of the reason for the alert.
A concise description of the reason for the recovery.
Monitor status (for example, "down").
Open alert details and context in Synthetics app.
## Uptime monitor status
- Elastic Cloud Serverless: Unavailable
- Elastic Stack: Deprecated since 8.15
**The Uptime app and the Uptime monitor status rule are deprecated as of version 8.15.0.**If you are using the Uptime monitor status rule with the Uptime app, you should migrate the Uptime monitor and the Uptime monitor status rule to Elastic Synthetics and the Synthetics monitor rule.If you are using the Uptime monitor status rule with a monitor created with Elastic Synthetics, you should migrate the Uptime monitor status rule to the Synthetics monitor rule. Learn how in [Migrate from the Uptime rule to the Synthetics rule](#migrate-monitor-rule).
Within the Uptime app, create a **Monitor Status** rule to receive notifications based on errors and outages.
1. To access this page, go to **Observability** → **Uptime**.
2. At the top of the page, click **Alerts and rules** → **Create rule**.
3. Select **Monitor status rule**.
If you already have a query in the overview page search bar, it’s populated here.
### Conditions
You can specify the following thresholds for your rule.
| | |
|------------------|---------------------------------------------------------------------------------------------------------------------------------|
| **Status check** | Receive alerts when a monitor goes down a specified number oftimes within a time range (seconds, minutes, hours, or days). |
| **Availability** | Receive alerts when a monitor goes below a specified availabilitythreshold within a time range (days, weeks, months, or years). |
Let’s create a rule for any monitor that shows `Down` more than three times in 10 minutes.
This rule covers all the monitors you have running. You can use a query to specify specific monitors, and you can also have different conditions for each one.
The final step when creating a rule is to select one or more actions to take when the alert is triggered.
### Action types
You can extend your rules by connecting them to actions that use the following supported built-in integrations. Actions are Kibana services or integrations with third-party systems that run as background tasks on the Kibana server when rule conditions are met.
You can configure action types on the [Settings](/elastic/docs-builder/docs/3028/solutions/observability/uptime/configure-settings#configure-uptime-alert-connectors) page.
After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour:
Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: `Uptime Down Monitor` or `Recovered`.
### Action variables
Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables.
### Alert recovery
To receive a notification when the alert recovers, select **Run when Recovered**. Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables.
## Migrate from the Uptime rule to the Synthetics rule
If you are currently using the Uptime monitor status with a monitor created with Elastic Synthetics, you should migrate the Uptime monitor status rule to:
- If you were using the Uptime rule for **synthetic monitor *status* checks**, you can recreate similar functionality using the [Synthetics monitor rule](#migrate-monitor-rule-synthetics-rule).
- If you were using the Uptime rule for **synthetic monitor *availability* checks**, there is no equivalent in the Synthetics monitor rule. Instead, you can use the [Synthetics availability SLI](#migrate-monitor-rule-synthetics-sli) to create similar functionality.
### Uptime status check to Synthetics monitor rule
#### Filters
The KQL syntax that you used in the Uptime monitor status rule is also valid in the **Filter by** section of the Synthetics monitor status rule. The Synthetics monitor status rule also offers dropdowns for several categories for easy filtering. However, you can still use KQL syntax for these categories if you prefer.
#### Conditions
If you are using the *Uptime availability condition* refer to [Uptime availability check to Synthetics availability SLI](#migrate-monitor-rule-synthetics-sli).
If you’re using the Uptime status check condition, you can recreate similar effects using the following Synthetics monitor status rule condition equivalents:
| | Uptime | Synthetics equivalent |
|-----------------------------------------|-------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|
| **Number of times the monitor is down** | `ANY MONITOR IS DOWN >=` `{{number}}` times (for example, `ANY MONITOR IS DOWN >=` `5` times) | `IS DOWN` `{{number}}` times (for example, `IS DOWN` `5` times) |
| **Timeframe** | `WITHIN last` `{{number}}` `{time range unit}` (for example, `WITHIN last` `15` `minutes`) | `WITHIN THE LAST` `{{number}}` `{time range unit}` (for example, `WITHIN THE LAST` `15` `minutes`) |
#### Actions
The default messages for the Uptime monitor status rule and Synthetics monitor status rule are different, but you can recreate similar messages using [Synthetics monitor status rule action variables](#observability-monitor-status-alert-action-variables).
### Uptime availability check to Synthetics availability SLI
SLOs allow you to set clear, measurable targets for your service performance, based on factors like availability. The [Synthetics availability SLI](/elastic/docs-builder/docs/3028/solutions/observability/incident-management/create-an-slo#synthetics-availability-sli) is a service-level indicator (SLI) based on the availability of your synthetic monitors.
#### Filters
The KQL syntax that you used in the Uptime monitor status rule is also valid in the **Query filter** field of the Synthetics availability SLI.
#### Conditions
Use the following Synthetics availability SLI fields to replace the Uptime monitor status rule’s availability conditions:
| | Uptime | Synthetics equivalent |
|---------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|
| **Number of checks that are down relative to all checks run** | `ANY MONITOR IS UP IN <` `{{percent}}` of checks (for example, `ANY MONITOR IS UP IN <` `90%` of checks) | **Target / SLO (%)** field (for example, `90%`) |
| **Timeframe** | `WITHIN THE LAST` `{{number}}` `{time range unit}` (for example, `WITHIN THE LAST` `30` `days`) | **Time window** and **Duration** fields (for example, Time window: `Rolling`, Duration: `30 days`) |
#### Actions
After creating a new SLO using the Synthetics availability SLI, you can use the SLO burn rate rule. For more information about configuring the rule, see [Create an SLO burn rate rule](https://www.elastic.co/elastic/docs-builder/docs/3028/solutions/observability/incident-management/create-an-slo-burn-rate-rule).