Kibana Universal Alerting overview

Use Kibana Universal Alerting to detect conditions in your Elasticsearch data with ES|QL rules. You can track each problem as an alert from first detection through recovery and route its notifications through reusable action policies, or record matches for later analysis without sending notifications.

To open Kibana Universal Alerting, go to Alerting in the Observability navigation menu.

Note

Looking for Kibana Classic Alerting? Refer to the Kibana Classic Alerting overview instead. The two systems are separate, so APIs and instructions for one don't apply to the other.

If you tried Kibana Universal Alerting while it was experimental in Elastic Stack 9.5, upgrade to 9.6 or later to use the generally available version. The system changed significantly between 9.5 and 9.6. This documentation covers only the generally available version.

In Kibana Universal Alerting, you create and configure rules, action policies, and workflows. Kibana generates the other two building blocks, rule events and alerts, from your rules' matches.

  • Rules: Define what to watch for in your data and how often to check.
  • Rule events: Record each match as a document in .rule-events.
  • Alerts: Track one problem from first detection through recovery, so you triage one lifecycle per problem.
  • Action policies: Decide whether and when to invoke a workflow for an alert. You configure this on the policy, so you can change notifications without changing what each rule detects.
  • Workflows: Send the notification or run the automation, for example posting to Slack, sending an email, or calling a webhook.

A rule evaluates your data on a schedule, and Kibana writes each match as a rule event. The rule's configuration determines the next step:

  • Alert: Kibana groups the event into an alert. An action policy evaluates the alert and can invoke a workflow, which sends the notification or runs the automation.
  • No alert: The event stays in .rule-events for later analysis. You can query it in Discover, build dashboards, or feed it into another rule. These events (type: signal) don't appear on the Alerts page and aren't evaluated by action policies or lifecycle triggers.

For a step-by-step walkthrough of what happens after a rule runs, refer to How it works.

  • Get started: Learn how the system works and its key terms, then create your first rule in a hands-on tutorial.
  • Set up Kibana Universal Alerting: Check the requirements and turn on optional features.
  • Manage: Give your team the role privileges it needs, and manage the API keys that authorize rules, action policies, and workflows.
  • Rules: Define what to watch for in ES|QL, and decide which creation path fits your use case.
  • Alerts: Learn how alerts track a problem from first detection through recovery, and how to triage them.
  • Notifications and actions: Learn how action policies decide when to invoke a workflow, and how workflows send the notification.