---
title: Create and configure an action policy
description: Create action policies in the {{alerting-v2}}, configure matchers, Dispatch per, Frequency, and workflow destinations.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6525/explore-analyze/alerting/kibana-alerting-experimental/notifications/create-configure-action-policy
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Unavailable
---

# Create and configure an action policy
Action policies are part of the experimental alerting features in Kibana. Rules define what counts as a problem. Action policies define what happens when a problem is detected. They determine which episodes generate notifications, how episodes batch for dispatch, **frequency** limits on notifications, and where they're routed.
Because policies are separate from rules and global within a space, you can update notification behavior across many rules at once without touching detection logic, and you can route the same alerts differently depending on severity or source. You create and manage policies from the **Action policies** page, not from the rule form.
For matcher fields, grouping modes, frequency options, and dispatch outcomes, refer to [Action policy reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6525/explore-analyze/alerting/kibana-alerting-experimental/notifications/action-policy-reference).

## Policy fields


### Matcher

An optional KQL expression that filters which episodes this policy applies to. An empty matcher matches every episode in the space.
Use matchers to route different episodes to different policies, for example, one policy for `data.severity: "critical"` episodes routed to PagerDuty and another for warnings routed to Slack. For available fields and examples, refer to [Matcher fields](/elastic/docs-content/pull/6525/explore-analyze/alerting/kibana-alerting-experimental/notifications/action-policy-reference#matcher-fields).

### Grouping and frequency

**Dispatch per** controls how episodes batch into notifications. **Frequency** controls how often the policy can notify for each batch.
<table>
  | Dispatch per | What it does                                                                                                          | Available Frequency options                                                     |
  |--------------|-----------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------|
  | Episode      | One notification per episode.                                                                                         | - On status change  - On status change + repeat at interval  - Every evaluation |
  | Group        | Bundle episodes that share a field value. Specify **Group by** (for example `data.service.name` or `data.host.name`). | - At most once every…  - Every evaluation                                       |
  | Digest       | One notification for all matching episodes combined.                                                                  | Every evaluation                                                                |
</table>

For detailed descriptions, frequency options, and examples for each mode, refer to [Dispatch per options](/elastic/docs-content/pull/6525/explore-analyze/alerting/kibana-alerting-experimental/notifications/action-policy-reference#notification-grouping).

### Frequency

**Frequency** limits how often the policy can fire for a given notification group. The interval resets from the last time the policy fired, so successive notifications stay at least `interval` apart. Set a duration such as `1h` or `30m`. For available options by **Dispatch per** mode, refer to [Frequency](/elastic/docs-content/pull/6525/explore-analyze/alerting/kibana-alerting-experimental/notifications/action-policy-reference#throttle-strategies).

### Destinations

One or more workflows to invoke when the policy matches. Use the search field to find and attach workflows.

### Snooze

An optional time window during which the policy doesn't dispatch. Useful for planned maintenance or quiet periods without disabling the policy entirely.