Defining alerts

Kibana alerts can be created in a variety of apps including APM, Metrics, SIEM, Uptime and from Management UI. While alerting details may differ from app to app, they share a common interface for defining and configuring alerts that this section describes in more detail.

When an alert is created in an app, the app will display a flyout panel with three main sections to configure:

All alert share the following four properties in common:

Depending upon the Kibana app and context, you may be prompted to choose the type of alert you wish to create. Some apps will pre-select the type of alert for you.

Each alert type provides its own way of defining the conditions to detect, but an expression formed by a series of clauses is a common pattern. Each clause has a UI control that allows you to define the clause. For example, in an index threshold alert the WHEN clause allows you to select an aggregation operation to apply to a numeric field.

To add an action to an alert, you first select the type of action:

Each action must specify a connector instance. If no connectors exist for that action type, click "Add new" to create one.

Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See Action and connector types for details on the types of actions provided by Kibana and their properties.

Using the Mustache template syntax {{variable name}}, you can pass alert values at the time a condition is detected to an action. Available variables differ by alert type, and a list can be accessed using the "add variable" button.

You can attach more than one action. Clicking the "Add action" button will prompt you to select another alert type and repeat the above steps again.

To modify an alert after it was created, including muting or disabling it, use the alert listing in the Management UI.