Loading

Set up the experimental alerting system

This page covers what you need before using the experimental alerting system, and how to turn it on and off in your space.

  • Data in Elasticsearch: Rules can only detect conditions in data that already exists. Make sure the indices or data streams your rules will query are populated before creating rules. Refer to Ingest your data for options.
  • A space selected: Rules, action policies, and the privileges that control them are all space-scoped. Decide which space you'll work in before setting things up. Refer to Manage spaces to create or switch spaces.
  • Connectors configured (required for notifications): Action policies send notifications through workflows, which require at least one connector, for example, Slack, email, or PagerDuty.
  • Enterprise license (Stack deployments only, required for notifications): Workflows-based notifications require an Enterprise license. Rules and alert episodes work on any tier. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for the breakdown of available features and their associated subscription tiers.

The experimental alerting system is controlled by the alerting:v2:enabled advanced setting in Kibana. This setting is off by default. Turn it on to make the UIs for experimental alerting system features available in your space.

Role requirements

You must have the kibana_admin role or equivalent Stack Management access to turn on the alerting:v2:enabled advanced setting.

Steps

  1. Go to the Advanced Settings menu using the navigation menu or the global search field.
  2. Under Global settings, toggle on alerting:v2:enabled.

Role requirements

You must have the admin project role to turn on the alerting:v2:enabled advanced setting.

Step

Serverless has no Global Advanced Settings UI, so use Dev Tools to call the global settings API:

POST kbn:/internal/kibana/global_settings
{
  "changes": {
    "alerting:v2:enabled": true
  }
}
Note

The /internal/kibana/global_settings endpoint is an internal API and might change without notice. There is currently no public equivalent.

After turning on the setting, verify the experimental alerting system is accessible in your space:

  1. Use the global search field and enter Alerting v2 preview.
  2. Select the menu item from the results.

If the menu item doesn't appear immediately, refresh the page and search again. It might take a moment for the UI to reflect the updated setting.

To turn off the experimental alerting system, set alerting:v2:enabled to false.

Go to the Advanced Settings page and toggle off alerting:v2:enabled.

Use Dev Tools to call the global settings API:

POST kbn:/internal/kibana/global_settings
{
  "changes": {
    "alerting:v2:enabled": false
  }
}

Turning off the setting does not delete any data. Kibana retains your rules and action policies as saved objects, and keeps existing documents in .rule-events and .alert-actions. Turning the setting back on restores the experimental alerting system UI.

Important

Turning off alerting:v2:enabled hides the experimental alerting system UI but does not stop rules and action policies from running. To stop both entirely:

  • Elastic Stack - Set xpack.alerting_v2.enabled: false in kibana.yml
  • Serverless - On Serverless, the experimental alerting system is managed by Elastic. Contact Elastic support to turn it off.

After turning on the system, configure access to create or update a role with access to the experimental alerting system features and the data streams they write to.