---
title: Configure a rule in the experimental alerting system
description: Overview of configurable rule settings in the experimental alerting system: required settings (mode, query, schedule) and optional settings (severity, grouping, alert delay, recovery, no-data, tags).
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-a-rule
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# Configure a rule in the experimental alerting system
Rules in the experimental alerting system have three required settings and several optional ones. Start with the required settings in order. Only add optional settings once the detection logic is validated, for example by previewing results in the [query sandbox](/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/create-esql-rule#rule-builder-query-sandbox) when writing ES|QL directly. The following table links to a dedicated page for each setting with field descriptions, accepted values, and guidance on when to configure it.

| Setting                                                                                                                                                                         | Description                                                                                                                                      | Required             |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|----------------------|
| [Rule mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-mode)                 | Controls whether matching rows are grouped into an alert episode or remain available for later analysis.                                         | Required             |
| [ES|QL query](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-query)              | The detection logic and the parameters available in query expressions.                                                                           | Required             |
| [Schedule and lookback](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-schedule) | How often the rule evaluates and how far back the query looks. Schedule is required; lookback is optional but strongly recommended.              | Strongly reccomended |
| [Severity](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-severity)              | Assign severity levels to alert episodes using a `severity` column in query output.                                                              | Optional             |
| [Grouping](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-grouping)              | Track multiple subjects (hosts, services, users) as independent alert series in one rule.                                                        | Optional             |
| [Alert delay](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-alert-delay)        | Reduce noise with delay modes for opening alert episodes. Only when matches are grouped into an episode.                                         | Optional             |
| [Recovery condition](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-recovery)    | Whether an alert episode closes automatically, and how much confirmation it needs before it does. Only when matches are grouped into an episode. | Optional             |
| [No-data handling](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-no-data-handling)   | What the rule records when the base query returns no results. Only when matches are grouped into an episode.                                     | Optional             |
| [Tags and runbooks](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/configure-rule-tags)         | Free-form labels and investigation guides attached to the rule. Only when matches are grouped into an episode.                                   | Optional             |