Create a rule in the experimental alerting system
The experimental alerting system in Kibana provides several ways to create rules. For details on configurable rule settings and guidance on how to configure them, refer to Configure a rule.
| Option | Best for |
|---|---|
| Create an ES|QL rule | Full control over the query. Supports both a step-by-step form and a YAML editor. |
| Create using Elastic Agent Builder | When you know what you want to detect but aren't sure how to write the ES|QL. |
| Use the rule builder | Rules that follow a guided, form-based setup. |
| Create from Discover | When you already have an ES|QL query working in Discover and want to convert it into a rule. |
Note
For query examples ranging from a basic event filter to SLO burn rate and persistent breach detection, refer to ES|QL query patterns.