---
title: Create a rule from Discover in the experimental alerting system
description: Convert an ES|QL query from a Discover session into a rule in the experimental alerting system, with the query pre-filled and a preview panel for verifying grouping.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/explore-analyze/alerting/experimental-alerting-system/rules/create-rule-from-discover
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# Create a rule from Discover in the experimental alerting system
Convert an ES|QL query you've already built in Discover directly into a rule, without rewriting it. Because you test the query against live data in Discover first, you know it returns the shape you expect before the rule is ever saved.

## Entry points

Two paths lead to Discover-based rule creation:
- **Discover Alerts menu**: When you're in Discover with an active ES|QL query and the experimental alerting system is enabled, the Alerts menu includes a **Create ES|QL rule** option. The rule creation flyout opens pre-populated with the current query. This path is only available in ES|QL mode.
- **Rules page**: To create a rule, go to **Alerting V2 Preview** in the navigation menu or [global search](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/explore-analyze/find-and-organize/find-apps-and-objects), then go to **Rules**. When choosing a creation path, select the one that opens a flyout embedding a live Discover session, so you can compose and test the query before saving the rule.


## How it works

When you trigger rule creation from Discover, your ES|QL query pre-fills the **Create ES|QL rule** form. The rule creation form also shows a preview panel that reflects how your query partitions results into alert series. If your query uses a `BY` clause, the preview shows the series that would be evaluated on each run, letting you verify grouping logic against live data before committing to a schedule.
The rule creation flyout supports both a step-by-step form and a YAML editor. You can switch between them at any point. Edits are preserved when you return to the form view. The YAML editor includes ES|QL autocomplete in the query field.
For details on configurable rule settings and guidance on how to configure them, refer to [Configure a rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/explore-analyze/alerting/experimental-alerting-system/rules/configure-a-rule).

## Related pages

- [Create a rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/explore-analyze/alerting/experimental-alerting-system/rules/create-a-rule): Compare this creation path with the others.
- [ES|QL query patterns](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7448/explore-analyze/alerting/experimental-alerting-system/rules/esql-query-patterns): Query examples ranging from a basic event filter to SLO burn rate and persistent breach detection.