---
title: ES|QL query patterns for rules in the experimental alerting system
description: ES|QL query patterns for rules in Kibana's experimental alerting system, from basic event filters to SLO burn rates, silent source detection, and persistent breach checks.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/esql-query-patterns
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# ES|QL query patterns for rules in the experimental alerting system
The following pages cover ES|QL query patterns for rules in the experimental alerting system, ordered from the simplest starting point to advanced use cases. Start with [Your first rule query](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/esql-first-rule-query) if you're new, or jump to the pattern you need.

| Pattern                                                                                                                                                                              | What it solves                                                                                       | Complexity   |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|--------------|
| [Your first rule query](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/esql-first-rule-query)        | Alert on any individual event that matches a condition. No aggregation needed.                       | Beginner     |
| [Threshold queries](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/esql-threshold-queries)           | Alert when a metric crosses a limit. Covers single-series and grouped (per-host, per-service) rules. | Beginner     |
| [No-data detection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/esql-no-data-detection)           | Alert when a specific host or data source stops reporting.                                           | Intermediate |
| [SLO burn rate](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/esql-slo-burn-rate)                   | Alert when error budget consumption exceeds safe rates across multiple time windows.                 | Advanced     |
| [Persistent breach detection](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6523/explore-analyze/alerting/experimental-alerting-system/rules/esql-persistent-breach) | Alert when a condition has been continuously true across consecutive time buckets.                   | Advanced     |