---
title: Significant Events
description: Significant Events automatically correlates signals from your log streams into prioritized incidents using a combination of deterministic detection and AI-powered investigation.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/observability/streams/significant-events
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# Significant Events
Significant Events continuously converts raw log data into a ranked feed of incidents. The pipeline moves from broad to narrow. Many alerts fire, an AI agent narrows these down into findings, and the most important ones are surfaced as Significant Events.
For example: you onboard a stream, Significant Events extracts what's in it ("this stream contains a Python gRPC service called `recommendationservice` running on GKE"), generates targeted detection rules ("detect gRPC connection failures"), and runs those rules continuously. Results flow through discovery and surface as correlated Significant Events across your entire environment.

## Before you get started

Significant Events requires an **Enterprise license** or an active Enterprise trial.
To use Significant Events you also need a [Generative AI connector](https://docs-v3-preview.elastic.dev/elastic/kibana/tree/main/reference/connectors-kibana/gen-ai-connectors), which routes LLM calls.

## How the pipeline works

The pipeline runs in sequential phases that build on the output of the previous phase. Knowledge Indicator (KI) extraction and rule generation prepare your streams for detection and run on your schedule. Detection and discovery run continuously in the background after you enable Significant Events.

### 1. Knowledge indicator extraction

An LLM analyzes log samples from your streams and extracts services, infrastructure, dependencies, and failure patterns as Knowledge Indicators (KIs). Deterministic generators run in parallel to produce dataset statistics, log patterns, and error samples.

### 2. Rule generation

An LLM converts KIs into ES|QL alerting rules scoped to the services and failure modes present in each stream. Generated rules are saved as stream assets. Lower-severity rules stay unbacked until you review and promote them; high-severity detections are promoted automatically and begin running right away.

### 3. Rule execution and detection

Promoted rules execute on a specified schedule against stream logs and record a count of matches per time bucket to the `.rule-events` index. A Detection workflow runs change point aggregation against those per-rule counts and writes a detection record whenever the aggregation finds a statistically significant shift.

### 4. Discovery

Two agents run in sequence. The [Discovery agent](/elastic/docs-content/tree/main/solutions/observability/streams/significant-events/how-it-works#sig-events-hiw-discovery-agent) reads detection records, correlates signals across rules and streams, and writes discovery records. The [Judge agent](/elastic/docs-content/tree/main/solutions/observability/streams/significant-events/how-it-works#sig-events-hiw-triage) independently verifies each discovery and sets its status to open, closed, or dismissed.

## Learn more

Refer to the following pages for more information on Significant Events:
- [Operator guide](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/observability/streams/significant-events/operator-guide): Learn more about system impact, cost drivers, and operational procedures
- [How Significant Events works](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/observability/streams/significant-events/how-it-works): Understand how Significant Events processes data, what runs where, and how to trace results across the system
- [Knowledge Indicators](https://docs-v3-preview.elastic.dev/elastic/docs-content/tree/main/solutions/observability/streams/significant-events/knowledge-indicators): Get an in-depth overview of how KIs work