Compare alerting systems
Elastic offers three alerting systems, each suited to different use cases and workflows. For production, use Kibana alerting. The experimental alerting system is available to try, but it isn't ready for production use. Use this page to compare them by goal, feature, and availability.
Note
Elastic Security has its own detection rules, separate from these three systems. For threat detection, refer to Detections and alerts.
| Goal | Suggested system | Availability |
|---|---|---|
| Monitor metrics, logs, or uptime with ready-made rules and no query language | Kibana alerting |
|
| Write ES|QL to define exactly what to detect and what data each rule event carries | Experimental alerting system |
|
Record matches as rule events with type: signal for later analysis, without sending notifications |
Experimental alerting system |
|
| Query rule event history in Discover or build dashboards from rule event data | Experimental alerting system |
|
| Manage notification routing, grouping, and throttling in one place, reusable across rules | Experimental alerting system |
|
| Build highly custom notification logic with reusable, configurable workflows | Experimental alerting system |
|
| Build highly custom logic with scripting and chained inputs | Watcher |
|
| Kibana alerting | Experimental alerting system | Watcher | |
|---|---|---|---|
| Best for | Teams using built-in rule types with form-based setup | Teams that need control over detection, and over notification routing when matches are tracked as alert episodes | Custom alerting logic requiring scripting |
| Rule definition | Select a rule type and fill in parameters | Write an ES|QL query or use a rule builder with form-based setup | Write a JSON watch definition |
| How matches are stored | In-place updates, limited query support | Append-only rule events, queryable with ES|QL in Discover | Watch history index |
| Notifications | Configured per action on each rule | Action policies invoke reusable workflows, which send the notification; policies support throttling and conditions | Action-level throttling and conditions |
| Noise reduction | Snooze per rule or per alert, maintenance windows | Acknowledge or deactivate per alert episode, per-series snooze, maintenance windows, match condition routing in action policies | Action conditions and throttling |
| Available on Elastic Cloud Serverless | Yes | Yes,
|
No |
| Available on Elastic Stack | Yes | Yes,
|
Yes |