Create an alert rule from Discover

If you want to be notified when your data goes above or below a threshold within a time interval, turn the query and filters of a Discover session into an alert rule. The rule then checks your data on a schedule.

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. In ES|QL mode, Discover can also create a Kibana Universal Alerting rule. This option appears when the Universal Alerting advanced setting is on, you work in a space with the Classic or Observability solution view, and your role can create Kibana Universal Alerting rules. Refer to Create a Kibana Universal Alerting rule from Discover.

Before you begin

To create rules, you need a role that grants access to at least one rule type that Discover can create. If you don't have one, Discover hides the Create alert rule menu. To use Create search threshold rule, your role also needs access to rules in Stack Management and privileges for the Elasticsearch query rule type. For the privileges that rules need, refer to Alerting security and privileges.

Create the alert rule

Check that your data, query, and filters return the results you want an alert for.
In the application menu, select Create alert rule (or Alerts before 9.4), then select Create search threshold rule. If the data view has no time field, this option is unavailable. In ES|QL mode, a date field in the data view is enough.

The Create rule form is pre-filled with the latest query sent to Elasticsearch.
In the Create rule form, set the threshold and how often the rule runs. Refer to Elasticsearch query rule.
Select the connector that sends the notification. Refer to Connectors.
Select Save.

Result: The rule is saved and starts checking your data on its schedule.

Next steps

Alerting: Manage your rules and learn about the other rule types.

Create a Kibana Universal Alerting rule from Discover