New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Create and manage rules Index threshold »
Elastic Docs ›Kibana Guide [7.16] ›Alerting

Rule types

edit

Rule types

edit

A rule is a set of conditions, schedules, and actions that enable notifications. Kibana provides two types of rules: rules specific to the Elastic Stack and rules specific to a domain.

Some rule types are subscription features, while others are free features. For a comparison of the Elastic subscription levels, see the subscription page.

Stack rules

edit

Stack rules are built into Kibana. To access the Stack Rules feature and create and edit rules, users require the all privilege. See feature privileges for more information.

Index threshold

Aggregate field values from documents using Elasticsearch queries, compare them to threshold values, and schedule actions to run when the thresholds are met.

Elasticsearch query

Run a user-configured Elasticsearch query, compare the number of matches to a configured threshold, and schedule actions to run when the threshold condition is met.

Transform rules [beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

[beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Run scheduled checks on a continuous transform to check its health. If a continuous transform meets the conditions, an alert is created and the associated action is triggered.

Domain rules

edit

Domain rules are registered by Observability, Security, Maps and Machine Learning.

Observability rules

Detect complex conditions in the Logs, Metrics, and Uptime apps.

Security rules

Detect suspicous source events with pre-built or custom rules and create alerts when a rule’s conditions are met.

Maps rules

Run an Elasticsearch query to determine if any documents are currently contained in any boundaries from a specified boundary index and generate alerts when a rule’s conditions are met.

Machine learning rules [beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

[beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Run scheduled checks on an anomaly detection job to detect anomalies with certain conditions. If an anomaly meets the conditions, an alert is created and the associated action is triggered.
« Create and manage rules Index threshold »

On this page

Was this helpful?
Feedback