Notifications and actions for the experimental alerting system
Rules in the experimental alerting system don't send notifications directly. Instead, they produce alert episodes, and you use workflows and action policies to decide what happens next. For an explanation of how these two connect at runtime, refer to Connect workflows.
To use workflows, your role must have the appropriate privileges and your subscription must include workflows. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for a breakdown of available features by tier.
To send a notification or trigger an action from a rule in the experimental alerting system:
Build a workflow that defines what to do, for example, send a message, call a webhook, open a case, or run any other automation.
Create an action policy that routes alert episodes to that workflow. The action policy controls which alert episodes qualify, how they batch, and how often it invokes the workflow.
For actions that fire exactly once in response to a specific alert episode state change (such as opening a ticket when an episode is assigned) use an alert episode lifecycle trigger instead of an action policy. Refer to Connect workflows for a comparison of action policies and lifecycle triggers.
- Connect workflows: Understand how action policies and lifecycle triggers invoke workflows at runtime.
- About action policies: Understand how action policies evaluate and gate alert episodes.
- Create an action policy: Configure match conditions, grouping, frequency, and destinations.
- Action policy reference: Look up match condition fields, grouping modes, and frequency options.
- Manage action policies: Enable, disable, snooze, edit, or delete action policies.
- Reduce notification noise: Silence alert episodes using acknowledgment, snooze, and maintenance windows.