Compare alerting systems
Elastic offers three alerting systems, each suited to different use cases and workflows. For most new projects and projects on the most recent Kibana versions, the experimental alerting system is the recommended system. Use this page to compare them by goal, feature, and availability.
| Goal | Suggested system | Availability |
|---|---|---|
| Monitor metrics, logs, or uptime with ready-made rules and no query language | Kibana alerting |
|
| Use rules built for Elastic Security, Observability, APM, or Maps | Kibana alerting |
|
| Write ES|QL to define exactly what to detect and what data each alert episode or signal carries | Experimental alerting system |
|
| Record detections as signals for later analysis without opening episodes or sending notifications | Experimental alerting system |
|
| Query alert and signal history in Discover or build dashboards from rule event data | Experimental alerting system |
|
| Manage notification routing, grouping, and throttling in one place, reusable across rules | Experimental alerting system |
|
| Build highly custom notification logic with reusable, configurable workflows | Experimental alerting system |
|
| Build highly custom logic with scripting and chained inputs | Watcher |
|
| Kibana alerting | Experimental alerting system | Watcher | |
|---|---|---|---|
| Best for | Teams using built-in rule types with form-based setup | Teams that need full control over detection and notification routing | Custom alerting logic requiring scripting |
| Rule definition | Select a rule type and fill in parameters | Write an ES|QL query or use a rule builder with form-based setup | Write a JSON watch definition |
| Alert and signal data | In-place updates, limited query support | Append-only rule events for alert episodes and signals, queryable with ES|QL in Discover | Watch history index |
| Notifications | Configured per action on each rule | Centralized action policies, reusable across rules; supports action-level throttling and conditions | Action-level throttling and conditions |
| Noise reduction | Snooze per rule or per alert, maintenance windows | Per-episode acknowledge or deactivate, per-series snooze, maintenance windows, match condition routing in action policies | Action conditions and throttling |
| Available on Elastic Cloud Serverless | Yes | Yes,
|
No |
| Available on Elastic Stack | Yes | Yes,
|
Yes |