Set up the experimental alerting system

This page covers what you need before using the experimental alerting system, and how to turn it on and off.

You'll need the following to create rules and send notifications.

• Data in Elasticsearch: Rules can only detect conditions in data that already exists. Make sure the indices or data streams your rules will query are populated before creating rules. Refer to Ingest your data for options.
• A space selected: Rules, action policies, and the privileges that control them are all space-scoped. Decide which space you'll work in before setting things up. Refer to Manage spaces to create or switch spaces.
• Connectors configured (required for notifications): Workflows send notifications and require at least one connector, for example, Slack, email, or PagerDuty. Action policies invoke those workflows.
• Enterprise license (Stack deployments only, required for notifications): Workflows-based notifications require an Enterprise license. Refer to the subscription page for Elastic Cloud and Elastic Stack/self-managed for the breakdown of available features and their associated subscription tiers.

The experimental alerting system is controlled by the alerting:v2:enabled advanced setting in Kibana. This is a global setting, so turning it on makes the experimental alerting system available in every space, even though the rules and action policies you create in it are space-scoped.

1. Go to the Advanced Settings page using the navigation menu or the global search field.
2. Select the Global Settings tab, then turn on Alerting V2.
3. Go to Alerting V2 Preview in the navigation menu or global search to confirm the experimental alerting system is accessible in your space.

If the menu item doesn't appear immediately, refresh the page and search again. It might take a moment for the UI to reflect the updated setting.

To turn off the experimental alerting system, go to the Advanced Settings page, select the Global Settings tab, and turn off Alerting V2.

Turning off the setting does not delete any data. Kibana retains your rules and action policies as saved objects, and keeps existing documents in .rule-events and .alert-actions. Turning the setting back on restores the experimental alerting system UI.

After turning on the system:

• Configure access to create or update a role with access to the experimental alerting system features and the data streams they write to.
• Create your first rule to load sample data, write a detection query, and observe the alert lifecycle.