Create a rule from Discover in the experimental alerting system

When you build an ES|QL query in Discover that surfaces interesting patterns, you can convert it into a rule without rewriting the query. Starting from Discover means your query is already tested and returns the shape you expect before the rule is ever saved.

Two paths lead to Discover-based rule creation:

• Discover Alerts menu: When you're in Discover with an active ES|QL query and the experimental alerting system is enabled, the Alerts menu includes a Create ES|QL rule option. The rule creation flyout opens pre-populated with the current query. This path is only available in ES|QL mode.
• Rules list: Selecting the option to create a rule from Discover opens a flyout that embeds a live Discover session so you can compose and test the query before saving the rule.

When you trigger rule creation from Discover, your ES|QL query pre-fills the Create ES|QL rule form. The rule creation form also shows a preview panel that reflects how your query partitions results into alert series. If your query uses a BY clause, the preview shows the series that would be evaluated on each run, letting you verify grouping logic against live data before committing to a schedule.

The rule creation flyout supports both a step-by-step form and a YAML editing mode. You can switch between them at any point. Edits in YAML mode are preserved when you return to the form view. The YAML editor includes ES|QL autocomplete in the query field.

For details on configurable rule settings and guidance on how to configure them, refer to Configure a rule.