Type to search.

Create a rule in Kibana Universal Alerting

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Planned

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Planned

    We plan to add this functionality in a future Elastic Stack update. Subject to changes.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Kibana Universal Alerting provides several ways to create rules. Compare the options below and pick the one that best fits your workflow and how comfortable you are writing ES|QL.

Option Best for
Create an ES|QL rule Full control over the query. Supports both a step-by-step form and a YAML editor.
Create using Elastic Agent Builder When you know what you want to detect but aren't sure how to write the ES|QL.
Use the rule builder Selecting a rule type (currently Threshold Alert) and configuring it through structured inputs, without writing ES|QL by hand.
Create from Discover When you already have an ES|QL query working in Discover and want to convert it into a rule.