---
title: Investigate alerts in Kibana Universal Alerting
description: Investigate alerts. Understand what triggered an alert, assess metric behavior, find related alerts, review responders, and inspect underlying data.
url: https://www.elastic.co/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/investigate-alert-episodes
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Serverless Observability projects: Generally available
  - Elastic Stack: Planned
---

# Investigate alerts in Kibana Universal Alerting
From the **Alerts** page in Universal Alerting, select an alert to open its detail page, which surfaces what triggered the alert, its severity, recurring patterns, and response history, so you can investigate and coordinate a response.
Alerts from Kibana Classic Alerting rules open a simpler flyout instead. Refer to [Investigate alerts from Classic Alerting](#investigate-classic-alerts).

## Understand the trigger and scope

Each alert includes key context to answer the first questions in any investigation:
- **Grouping** - The value of the `BY` clause that identifies this alert's group, such as a hostname or service name. Use it to confirm which entity the rule is firing on.
- **Triggered** - When the alert opened.
- **Duration** - How long the alert has been active.
- **Assignee** - Who currently owns the alert, if anyone. To assign or reassign the alert, refer to [Triage alerts](https://www.elastic.co/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/triage-alert-episodes).

The **Rule overview** section shows the rule name, type, and status alongside a snippet of its ES|QL query. Select **View rule details** to open the full rule configuration and confirm exactly what condition the rule evaluates.

## Assess the metric behavior

If a rule's query compares a metric to a threshold, as a rule created with the threshold builder does, each of its alerts shows a trend chart. The chart compares the evaluated metric against the threshold conditions over the alert's lifetime. Use it to understand how far the metric exceeded the threshold, whether the breach was escalating or stabilizing, and when it peaked.
When a rule includes multiple threshold conditions:
- Conditions that compare the **same metric** appear together, with each threshold represented separately.
- Conditions that compare **different metrics** appear in separate views, one for each metric.

Rules with other query shapes, and rules that don't group matches into an alert, don't show the chart.
The alert timeline shows its full duration as a horizontal bar, from when it was triggered to its most recent evaluation or close time.

## Check for related or recurring alerts

Related alerts from the same rule are grouped to help you answer whether this is an isolated incident or part of a larger pattern:
- **Same alert group** - Alerts for this rule that share the same group as the current alert (same `group_hash`). A long list here suggests the underlying condition isn't being fully resolved between alerts.
- **Other groups for this rule** - Alerts from the same rule firing on different entities (different `group_hash`). Use this to gauge how broadly the rule is triggering across your environment.


## Spot a flapping alert

A flapping alert keeps changing status instead of staying active or closing, so its status doesn't tell you whether the problem is ongoing or fixed. To warn you not to rely on that status, Kibana marks the alert as **Flapping**. Kibana shows the mark in different places for alerts from Universal Alerting and Classic Alerting rules, and uses different criteria to add it:

| Behavior                                | Universal Alerting alerts                                                                                                                                                                                                 | Classic Alerting alerts                                                                                                                                                                                                                                              |
|-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| In the **Alerts** table                 | The table doesn't show that the alert is flapping.                                                                                                                                                                        | A `chart_gauge` **Flapping** icon appears in the **Status** column while the alert is active.                                                                                                                                                                        |
| In the alert details                    | A **Flapping** badge appears next to the status, including after the alert becomes `inactive`. Select the badge to see why Kibana added it.                                                                               | No badge appears. On the **Fields** tab, `kibana.alert.flapping` is `true` when the alert is flapping.                                                                                                                                                               |
| When Kibana marks the alert as flapping | The alert's last 20 rule events include at least 4 changes between `active` and `recovering`. Kibana doesn't check alerts with fewer than 20 rule events, and changes into or out of `pending` or `inactive` don't count. | The Classic Alerting [flapping settings](/elastic/docs-builder/docs/4843/explore-analyze/alerting/alerts/create-manage-rules#defining-rules-flapping-details) decide when an alert is flapping.                                                                      |
| How to respond                          | Follow the steps in [Triage a flapping alert](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/triage-alert-episodes#triage-flapping).                                                                | Acknowledging the alert doesn't stop its notifications. For other differences, refer to [How actions affect alerts from Classic Alerting](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/triage-alert-episodes#classic-triage-action-results). |

<tip>
  If a Universal Alerting alert's status in the **Alerts** table keeps changing between `active` and `recovering`, open the alert details to check for the **Flapping** badge. If an [action policy](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/action-policies/create-configure-action-policy#reduce-noise-grouping) notifies on status changes, repeated notifications for the same alert are another reason to check.
</tip>


## Review who has responded

Each alert tracks who performed the most recent response action of each type, so you can avoid duplicating work or missing a step someone else already handled:
- **Acknowledged by** - The user who most recently acknowledged the alert.
- **Resolved by** - The user who most recently resolved the alert.
- **Snoozed by** - The user who snoozed the alert, shown together with the **Snoozed until** time.

These rows only appear when the alert is in the corresponding state. System-generated actions display as **System**.

## Check whether an alert's notifications went out

To find out whether Kibana sent a notification for an alert, open the **Policy history** tab on the alert's details page. For each time an action policy handled the alert since it started, the tab shows whether the policy sent the notification (**Dispatched**), held it back because of its frequency setting (**Throttled**), or failed to send it (**Failed**).
To narrow the list, filter by outcome or search it. To check which alerts a policy matches and where it sends notifications, select the policy's name.
If a notification you expected isn't listed, no action policy tried to send it. This happens when:
- No action policy matches the alert.
- The alert is acknowledged, snoozed, or resolved.
- A maintenance window covers the alert.

An empty tab means no action policy has handled the alert yet, even though the empty message mentions the last 24 hours.
To review notifications for every alert in the space, use the [action policy execution history](https://www.elastic.co/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/action-policies/review-action-policy-execution-history).

## Inspect the underlying data

Each alert includes a **Data container** tab that shows the field values computed or retained by the rule's ES|QL query. For example, a query using `STATS ... BY` stores aggregated values, not all fields from the underlying events. Use it to inspect rule-specific context such as resource identifiers or computed metrics. You can search by field name or value and toggle off null fields to focus on populated data.
<tip>
  Use the **Open in Discover** action to view the full source documents instead of these computed values. The action runs the rule's base query in Discover, aligned with the alert's timeframe. Once there, adjust the query to see what you need. For example, remove the aggregation to return source documents instead of aggregated output.
</tip>


## Access the response runbook

If the rule has a runbook attached, you can view it directly from the alert to follow the documented triage steps.

## Investigate alerts from Classic Alerting

Select an alert with **Classic** in the **Source** column to open its details flyout, then use its tabs to check the alert:
- **Overview**: Check the alert's status, severity, reason, and timing, along with its rule and the rule's tags.
- **Fields**: Look up any value stored on the alert, such as the rule type in `kibana.alert.rule.rule_type_id`.

Trend charts, timelines, and related alerts are available only for Universal Alerting alerts.
To triage the alert from the flyout, use the **Take action** menu. It has the same actions as the alerts table on the **Alerts** page. For details, refer to [Triage alerts from Kibana Classic Alerting](/elastic/docs-builder/docs/4843/explore-analyze/alerting/esql/alerts/triage-alert-episodes#triage-classic-alerts).
Alerts from Observability rules also have a details page in Observability. To open it, select **Take action** → **View details**.