Compare alerting systems
Elastic offers three alerting systems, each suited to different use cases and workflows. For most new projects and projects on the most recent Kibana versions, the experimental alerting system is the recommended system. Use this page to compare them by goal, feature, and availability.
| Goal | Suggested system | Availability |
|---|---|---|
| Monitor metrics, logs, or uptime with ready-made rules and no query language | Kibana alerting |
|
| Use rules built for Elastic Security, Observability, APM, or Maps | Kibana alerting |
|
| Write ES|QL to define exactly what to detect and what data each alert episode carries | Experimental alerting system |
|
| Query alert history in Discover or build dashboards from alert data | Experimental alerting system |
|
| Manage notification routing, grouping, and throttling in one place, reusable across rules | Experimental alerting system |
|
| Build highly custom notification logic with reusable, configurable workflows | Experimental alerting system |
|
| Build highly custom logic with scripting and chained inputs | Watcher |
|
| Kibana alerting | Experimental alerting system | Watcher | |
|---|---|---|---|
| Best for | Teams using built-in rule types with form-based setup | Teams that need full control over detection and notification routing | Custom alerting logic requiring scripting |
| Rule definition | Select a rule type and fill in parameters | Write an ES|QL query or use a rule builder with form-based setup | Write a JSON watch definition |
| Alert data | In-place updates, limited query support | Append-only events queryable with ES|QL in Discover | Watch history index |
| Notifications | Configured per action on each rule | Centralized action policies, reusable across rules; supports action-level throttling and conditions | Action-level throttling and conditions |
| Noise reduction | Snooze per rule, maintenance windows | Per-episode acknowledge or deactivate, per-series snooze, maintenance windows, match condition routing in action policies | Action conditions and throttling |
| Available on Elastic Cloud Serverless | Yes | Yes,
|
No |
| Available on Elastic Stack | Yes | Yes,
|
Yes |