Review rule execution history in Kibana Universal Alerting
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Planned
Planned
Rule execution history gives you a cross-rule, filterable log of every Kibana Universal Alerting rule run in the space, so you can confirm rules are running on schedule or spot patterns that aren't visible when looking at individual rules, such as a cluster of failures at the same timestamp that points to a shared dependency issue.
Go to Alerting → Execution History in the Observability navigation menu, or find Execution History using the global search field. Then select the Rules tab, which lists the following for each rule evaluation:
| Column | Description |
|---|---|
| Timestamp | When the rule execution ran. |
| Rule | The rule that ran. Selecting the rule name opens a summary so you can inspect the rule without leaving the page. |
| Duration | How long the execution took. |
| Response | The outcome of the run. Can be success or failure. |
| Message | An optional message included with the execution result, typically an error description for failed runs. |
Use the Response filter to view only successful or failed executions. Filtering is applied server-side. Results are paginated up to 100 per page. You can page through up to 10,000 records.
- Review action policy execution history: Monitor dispatcher outcomes for the notifications a rule's alerts trigger.
- View and manage rules: Find the rule behind a specific execution and inspect or edit it.
- Review rule change history: See who changed a rule's configuration and when, rather than how its runs went.
- Rule events: Understand the underlying
.rule-eventsdocuments Kibana writes on each execution.