---
title: Set up Kibana Universal Alerting
description: License, connector, data, and space requirements, plus how to turn the system on and off.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/setup
products:
  - Elastic Cloud Serverless
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# Set up Kibana Universal Alerting
Check the requirements for Kibana Universal Alerting, turn it on or off for all spaces, and turn on optional features in the spaces where you want them.

## Before you use the system

You'll need the following to create rules and send notifications.
- **Data in Elasticsearch**: Rules can only detect conditions in data that already exists. Make sure the indices or data streams your rules will query are populated before creating rules. Refer to [Ingest your data](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/manage-data/ingest) for options.
- **A space selected**: Rules, [action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/about-action-policies), and the privileges that control them are all space-scoped. Decide which space you'll work in before setting things up. Refer to [Manage spaces](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/manage-spaces) to create or switch spaces.
- **Connectors configured** (required for notifications): [Workflows](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/workflows-alerting) send notifications and require at least one [connector](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/manage-connectors), for example, Slack, email, or PagerDuty. [Action policies](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/action-policies/about-action-policies) invoke those workflows.
- **Enterprise license** (Stack deployments only, required for notifications): Workflows-based notifications require an Enterprise license. Refer to the subscription page for [Elastic Cloud](https://www.elastic.co/subscriptions/cloud) and [Elastic Stack/self-managed](https://www.elastic.co/subscriptions) for the breakdown of available features and their associated subscription tiers.


## Turn on the system

Kibana Universal Alerting is controlled by the [`alerting:v2:enabled`](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/advanced-settings#alerting-v2-enabled) advanced setting in Kibana. This is a global setting, so turning it on makes Kibana Universal Alerting available in every space, even though the rules and action policies you create in it are space-scoped.
The setting's default state depends on your version:
- <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> The setting is on by default. If you turned the setting off, it stays off, even after an upgrade.
- <applies-to>Elastic Stack: Experimental in 9.5</applies-to> The setting is off by default.

To turn on the setting:
1. Go to the **Advanced Settings** page using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/find-and-organize/find-apps-and-objects).
2. Select the **Global Settings** tab, turn on `alerting:v2:enabled`, save the change, then refresh the page.
3. Confirm that Kibana Universal Alerting is accessible in your space. Find **Rules** using the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/find-and-organize/find-apps-and-objects), or go to:
   - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> **Alerting** → **Rules** in the Observability navigation menu
- <applies-to>Elastic Stack: Experimental in 9.5</applies-to> **Stack Management** → **Alerting V2 Preview** → **Rules**


## Turn off the system

To turn off Kibana Universal Alerting, go to the **Advanced Settings** page, select the **Global Settings** tab, and turn off `alerting:v2:enabled`.
Turning off the setting hides the Kibana Universal Alerting UI and turns off its APIs, but it doesn't delete any data. Kibana keeps your rules and action policies as saved objects, along with existing documents in `.rule-events` and `.alert-actions`. Turning the setting back on restores the UI and APIs.

### Stop rules and action policies from running

Turning off the setting doesn't stop rules and action policies from running. To stop them, use the option for your deployment:
- <applies-to>Elastic Cloud Serverless: Generally available</applies-to> [Contact Elastic support](/elastic/docs-content/tree/main/troubleshoot#contact-us).
- <applies-to>Elastic Stack: Experimental in 9.5</applies-to> Set `xpack.alerting_v2.enabled: false` in [`kibana.yml`](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/deploy-manage/stack-settings), then restart Kibana.


## Try experimental features in a space

<applies-to>
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
</applies-to>

To try features of Kibana Universal Alerting that are still experimental, turn on the **Universal Alerting: Experimental Features** advanced setting (`alerting:v2:experimentalFeatures`). The setting is off by default and applies only to the space where you turn it on.
When the setting is on, you can:
- Detect multi-step alert patterns by chaining rules into a sequence. On the **Rules** page, select **Build a sequence (Experimental)**.
- Create rules and action policies by describing them to Elastic Agent Builder in natural language. Select **Create rule** → **Create with agent (Experimental)** on the **Rules** page, or **Create policy** → **Create with agent (Experimental)** on the **Action Policies** page. Elastic Agent Builder has [its own requirements](/elastic/docs-content/tree/main/explore-analyze/alerting/esql/rules/create-rules-action-policies-agent-builder#create-ai-agent-requirements).

To turn on experimental features:
1. Switch to the space where you want to use the features.
2. Go to the **Advanced Settings** page using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/find-and-organize/find-apps-and-objects).
3. Select the **Space Settings** tab, then turn on **Universal Alerting: Experimental Features**.
4. Select **Save changes**, then reload Kibana.


## Keep the Observability alerts page for Kibana Classic Alerting

<applies-to>
  - Serverless Observability projects: Generally available
  - Elastic Stack: Planned
</applies-to>

When Kibana Universal Alerting is on, an **Alerting** menu replaces the Observability **Alerts** link. Its **Alerts** page lists alerts from both systems, even if you keep the old page.
To keep using the Observability alerts page that lists only alerts from Kibana Classic Alerting rules, turn on the **Classic Alerting: Show Classic Alerts table** advanced setting (`alerting:v1:showV1ObservabilityAlertsTable`). The page then appears as **Alerts (Classic)** in the **Alerting** menu and in global search results. The setting is off by default and applies only to the space where you turn it on.
To show the **Alerts (Classic)** page:
1. Switch to the space where you want the page.
2. Go to the **Advanced Settings** page using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/find-and-organize/find-apps-and-objects).
3. Select the **Space Settings** tab, then turn on **Classic Alerting: Show Classic Alerts table**.
4. Select **Save changes**, then reload Kibana.


## Next steps

After you meet the requirements and the system is on:
- [Configure access](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/manage/configure-access) to create or update a role with access to the Kibana Universal Alerting features and the data streams they write to.
- [Create your first rule](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/explore-analyze/alerting/esql/get-started/create-your-first-rule) to load sample data, write a detection query, and observe the alert lifecycle.