Set up Kibana Universal Alerting

Kibana Universal Alerting is on by default. Check that you have what you need to create rules, then turn on any optional features you want.

Note

If you tried Kibana Universal Alerting while it was experimental in Elastic Stack 9.5, upgrade to 9.6 or later. The system changed a lot before it became generally available, and these docs cover only the generally available version.

Before you begin

Data to query: Rules can only find conditions in data that's already in Elasticsearch. Ingest your data before you create rules.
A space to work in: Rules, action policies, and the privileges that control them belong to a single space. Create or switch spaces if you need to.
A connector, if you want notifications: Workflows send notifications through connectors, such as Slack, email, or PagerDuty.
An Enterprise license, if you want notifications on Elastic Stack: Compare subscriptions for Elastic Cloud and self-managed deployments.

Adjust Kibana Universal Alerting settings

Three advanced settings change how Kibana Universal Alerting works. A space setting applies only to the space where you change it. A global setting applies to every space.

Setting	Scope	Default	Use it to
Universal Alerting: Experimental Features (`alerting:v2:experimentalFeatures`)	Space	Off	Try experimental features
Classic Alerting: Show Classic Alerts table (`alerting:v1:showV1ObservabilityAlertsTable`)	Space	Off	Keep the Observability Alerts page
Universal Alerting (`alerting:v2:enabled`)	Global	On	Opt out of Kibana Universal Alerting

Try experimental features in a space

Experimental features are new Kibana Universal Alerting capabilities that are still in development. They can change or be removed in a future release, so avoid relying on them in production.

To turn them on:

Switch to the space where you want the features.
Go to the Advanced Settings page using the navigation menu or the global search field.
On the Space Settings tab, turn on Universal Alerting: Experimental Features.
Select Save changes, then reload Kibana.

Keep the Observability Alerts page for Kibana Classic Alerting

With Kibana Universal Alerting on, a new Alerts page that shows alerts from both systems replaces the Observability Alerts page, which shows only Kibana Classic Alerting alerts. You can find the new page in the Alerting menu. To keep the old page as well, turn on the Classic Alerting: Show Classic Alerts table setting. The old page then appears as Alerts (Classic) in the Alerting menu.

To show the Alerts (Classic) page:

Switch to the space where you want the page.
Go to the Advanced Settings page using the navigation menu or the global search field.
On the Space Settings tab, turn on Classic Alerting: Show Classic Alerts table.
Select Save changes, then reload Kibana.

Opt out of Kibana Universal Alerting

To turn off Kibana Universal Alerting in every space:

Go to the Advanced Settings page using the navigation menu or the global search field.
On the Global Settings tab, turn off Universal Alerting.
Select Save changes, then reload Kibana.

This hides the UI and turns off the APIs. Your rules, action policies, and alert history stay in place, and the setting stays off after upgrades.

Rules and action policies keep running after you turn off the setting. To stop them:

Contact Elastic support.
Set xpack.alerting_v2.enabled: false in kibana.yml, then restart Kibana.

Next steps

Create your first rule to try Kibana Universal Alerting with sample data.