View and manage alerts
When a rule in the experimental alerting system detects a problem, the Alerts page gives you health summaries and filtering tools to understand what's happening. For triage actions (acknowledge, snooze, resolve, activate, and tag), refer to Triage alert episodes. For episode lifecycle history, related episodes, and assignment, refer to Investigate alert episodes.
Alert episodes belong to the current Kibana space and aren't visible in other spaces.
The Alerts page includes two summary panels:
- KPI panels - Show aggregate episode counts for the current filter state and time range. Use them to understand the scale of a situation before reviewing individual episodes.
- Episode histogram - Shows the total number of episodes that existed within each time interval. A long-lived episode counts in every interval it was open, not only the one it started in. Brush the chart to update the time filter. You can break down the chart by status, rule, or assignee.
Note
The episode histogram queries up to 10,000 alert episodes for each time range. Narrow the time range or add filters if you exceed this limit.
- Rule - Limit to one or more rules.
- Status - Limit by lifecycle state (active, recovered, pending, inactive).
- Tags - Limit to episodes matching any selected tag. Tag choices come from tag actions in the selected time range.
- Search - Text search over alert event document fields.
Tip
Narrow the time range when filters return too many results or tag options need refreshing.