---
title: Route alerts by severity in Kibana Universal Alerting
description: How to route alerts to different workflows based on severity level.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/action-policies/route-by-severity
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# Route alerts by severity in Kibana Universal Alerting
To send critical and non-critical alerts to different workflows in Kibana Universal Alerting, scope one action policy per severity.
For example, you might page an on-call team for critical alerts while sending lower-severity alerts to a Slack channel for async review.

| Field                | Action Policy A        | Action Policy B                                             |
|----------------------|------------------------|-------------------------------------------------------------|
| **Match conditions** | `severity: "critical"` | `severity: "low" OR severity: "medium" OR severity: "high"` |
| **Notify per**       | Alert                  | Alert                                                       |
| **Frequency**        | On status change       | On status change                                            |
| **Destinations**     | PagerDuty workflow     | Slack workflow                                              |

Each action policy evaluates alerts independently.
- An alert with `severity: "critical"` matches Action Policy A but not Action Policy B.
- An alert with `severity: "high"` matches Action Policy B but not Action Policy A.
- If an alert's severity changes mid-lifecycle, the action policies that match it change accordingly. For example, if an alert escalates from `high` to `critical`, Action Policy A starts matching and Action Policy B stops matching. Action Policy A fires because it has no prior notification record for that alert.


## Related pages

- [Manage severity escalation notifications](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/action-policies/severity-escalation): Understand what happens when an alert that has already matched an action policy changes severity.
- [Action policy reference](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/action-policies/action-policy-reference): Look up match condition fields, grouping modes, and frequency options.
- [Create and configure an action policy](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/action-policies/create-configure-action-policy): Set up an action policy with match conditions.