Kibana alerting v2 activation and recovery thresholds
Activation and recovery thresholds control when alerts transition between lifecycle states. They prevent transient spikes from creating actionable alerts and prevent rapid toggling between active and recovered.
These settings are only available for alert-mode rules (kind: alert).
An alert transitions through these states:
inactive → pending → active → recovering → inactive
Configure activation using count, timeframe, or both:
| Field | Description |
|---|---|
pending_count |
Consecutive breaches required |
pending_timeframe |
Minimum duration the condition must persist |
pending_operator |
How to combine count and timeframe (AND or OR) |
| Field | Description |
|---|---|
recovering_count |
Consecutive recoveries required |
recovering_timeframe |
Minimum duration for recovery |
recovering_operator |
How to combine count and timeframe (AND or OR) |