Create an alert rule from Discover

If you want to be notified when your data goes above or below a threshold within a time interval, turn the query and filters of a Discover session into an alert rule. The rule then checks your data on a schedule.

In ES|QL mode, Discover can also create a Kibana Universal Alerting rule. This option appears when the Universal Alerting advanced setting is on, you work in a space with the Classic or Observability solution view, and your role can create Kibana Universal Alerting rules. Refer to Create a Kibana Universal Alerting rule from Discover.

To create rules, you need a role that grants access to at least one rule type that Discover can create. If you don't have one, Discover hides the Create alert rule menu. To use Create search threshold rule, your role also needs access to rules in Stack Management and privileges for the Elasticsearch query rule type. For the privileges that rules need, refer to Alerting security and privileges.

  1. Check that your data, query, and filters return the results you want an alert for.

  2. In the application menu, select Create alert rule (or Alerts before 9.4), then select Create search threshold rule. If the data view has no time field, this option is unavailable. In ES|QL mode, a date field in the data view is enough.

    The Create rule form is pre-filled with the latest query sent to Elasticsearch.

  3. In the Create rule form, set the threshold and how often the rule runs. Refer to Elasticsearch query rule.

  4. Select the connector that sends the notification. Refer to Connectors.

  5. Select Save.

Result: The rule is saved and starts checking your data on its schedule.

  • Alerting: Manage your rules and learn about the other rule types.