Type to search.

Create a rule in Kibana Universal Alerting using the rule builder

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack Planned

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Planned

    We plan to add this functionality in a future Elastic Stack update. Subject to changes.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The Kibana Universal Alerting rule builder lets you create a rule by selecting a rule type and configuring it through structured inputs, instead of writing ES|QL directly. Behind the scenes, the rule builder generates the ES|QL query for you from the data source, aggregation, filters, and alert conditions you set.

To create a rule, go to Alerting → Rules in the Observability navigation menu, or find Rules using the global search field.

Then select the creation path in the rule builder section.

Note

The rule builder differs from the Rule form described in Create an ES|QL rule. The Rule form is for writing an ES|QL query directly, with a live preview of results. The rule builder instead has you select a rule type, then fills in the query for you based on the structured inputs you provide for that type.

Threshold Alert is the only rule type available in the rule builder. Use it to monitor metrics against one or more threshold conditions. Custom aggregations let you control how metric values are computed before they are compared to the threshold.