---
title: View and manage alerts in Kibana Universal Alerting
description: Monitor alerts with KPI panels, a histogram, and filters. Triage and investigate alerts from the same page.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts/view-and-manage-alerts
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# View and manage alerts in Kibana Universal Alerting
In Kibana Universal Alerting, use the **Alerts** page to monitor alerts with KPI panels, a histogram, and filters. To open it, go to **Alerting** → **Alerts** in the Observability navigation menu, or find **Alerts** using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/find-and-organize/find-apps-and-objects).
<applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> The page also lists alerts from Kibana Classic Alerting rules, so you can monitor and triage alerts from both systems in one table. Refer to [View alerts from both alerting systems](#alerts-from-both-systems).
To silence, close, or tag alerts, refer to [Triage alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts/triage-alert-episodes). For alert lifecycle history, related alerts, and assignment, refer to [Investigate alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts/investigate-alert-episodes).

## Space scoping

Alerts belong to the current Kibana space, and the alerting pages list only that space's alerts. If you have access to several spaces, or direct access to the underlying alert indices, you can see alerts from other spaces, for example in Discover.

## Monitor alert health and trends

The Alerts page includes two summary panels:
- **KPI panels**: Show aggregate alert counts for the current filter state and time range. Use them to understand the scale of a situation before reviewing individual alerts.
- **Histogram**: Shows the total number of alerts that existed within each time interval. A long-lived alert counts in every interval it was open, not only the one it started in. Brush the chart to update the time filter. You can break down the chart by status, rule, acknowledgment, or assignee.

<note>
  The histogram queries up to 10,000 alerts for each time range. Narrow the time range or add filters if you exceed this limit.
</note>


## Filter and search

Use the following controls on the **Alerts** page to narrow the alert list:
- **Rule**: Limit to one or more rules.
- **Status**: Limit by lifecycle state (inactive, pending, active, recovering).
- **Severity**: Limit to one or more severity levels.
- **Alert tags** or **Tags** (depending on your Elastic Stack version): Limit to alerts matching any selected tag. Tag choices come from the tags on alerts in the selected time range.
- **Assignee**: Limit to alerts assigned to one or more users.
- **Search**: Text search over alert event document fields.

<tip>
  Narrow the time range when filters return too many results or tag options need refreshing.
</tip>


## View alerts from both alerting systems

<applies-to>
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
</applies-to>

To tell alerts from the two systems apart, check the **Source** column: **Universal** for Kibana Universal Alerting or **Classic** for Kibana Classic Alerting. To act on Kibana Classic Alerting alerts from the **Alerts** page, refer to [Triage alerts from Kibana Classic Alerting](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/alerts/triage-alert-episodes#triage-classic-alerts).

### Which alerts from Kibana Classic Alerting appear

You see a Kibana Classic Alerting alert only if your role can view alerts from its rule type. For the privileges, refer to [Configure access](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/manage/configure-access#alerting-classic-alert-privileges).
The table includes Kibana Classic Alerting alerts from these rule types:
- **Observability rules**: APM, Synthetics, Uptime, Metric threshold, Inventory, Log threshold, SLO burn rate, and Custom threshold
- **Stack rules**: Elasticsearch query, Index threshold, Tracking containment, Transform health, and Anomaly detection


### How alerts from Kibana Classic Alerting differ

Kibana Classic Alerting alerts appear in the KPI panels, histogram, and filters like any other alert, with these differences:
- They use only the **Active** and **Inactive** statuses. A recovered or [untracked](/elastic/docs-content/tree/main/explore-analyze/alerting/alerts/view-alerts#alert-status) alert shows as **Inactive**.
- They can have the **Warning**, **Minor**, and **Major** severity levels, and can show the [**Flapping**](/elastic/docs-content/tree/main/explore-analyze/alerting/alerts/create-manage-rules#defining-rules-flapping-details) icon in the **Status** column.
- You can't assign them, so the **Assignee** filter doesn't apply to them and the KPI panels count them as unassigned.
- A search matches each alert's own fields. For example, a query on `kibana.alert.rule.name` matches Kibana Classic Alerting alerts but not Kibana Universal Alerting alerts.