---
title: Create an alert rule from Discover
description: Turn the query and filters of a Discover session into an alert rule that checks when your data goes above or below a threshold.
url: https://www.elastic.co/docs/explore-analyze/discover/generate-alerts-from-discover
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Create an alert rule from Discover
If you want to be notified when your data goes above or below a threshold within a time interval, turn the query and filters of a **Discover** session into an alert rule. The rule then checks your data on a schedule.
<applies-to>Elastic Cloud Serverless: Generally available</applies-to> <applies-to>Elastic Stack: Planned</applies-to> In ES|QL mode, **Discover** can also create a Kibana Universal Alerting rule. This option appears when the **Universal Alerting** advanced setting is on, you work in a space with the Classic or Observability solution view, and your role can create Kibana Universal Alerting rules. Refer to [Create a Kibana Universal Alerting rule from Discover](https://www.elastic.co/docs/explore-analyze/alerting/esql/rules/create-rule-from-discover).

## Before you begin

To create rules, you need a role that grants access to at least one rule type that **Discover** can create. If you don't have one, **Discover** hides the **Create alert rule** menu. To use **Create search threshold rule**, your role also needs access to rules in Stack Management and privileges for the Elasticsearch query rule type. For the privileges that rules need, refer to [Alerting security and privileges](/docs/explore-analyze/alerting/alerts/alerting-setup#alerting-security).

## Create the alert rule

1. Check that your data, query, and filters return the results you want an alert for.
2. In the application menu, select **Create alert rule** (or **Alerts** before 9.4), then select **Create search threshold rule**. If the data view has no time field, this option is unavailable. In ES|QL mode, a date field in the data view is enough.
   The **Create rule** form is pre-filled with the latest query sent to Elasticsearch.
3. In the **Create rule** form, set the threshold and how often the rule runs. Refer to [Elasticsearch query rule](https://www.elastic.co/docs/explore-analyze/alerting/alerts/rule-type-es-query).
4. Select the connector that sends the notification. Refer to [Connectors](https://www.elastic.co/docs/deploy-manage/manage-connectors).
5. Select **Save**.

**Result:** The rule is saved and starts checking your data on its schedule.

## Next steps

- [Alerting](https://www.elastic.co/docs/explore-analyze/alerting/alerts): Manage your rules and learn about the other rule types.


## Related pages

- [Create a Kibana Universal Alerting rule from Discover](https://www.elastic.co/docs/explore-analyze/alerting/esql/rules/create-rule-from-discover)