Create a monitor status rule

There are two types of monitor status rules:

Within the Synthetics UI, create a Monitor Status rule to receive notifications based on errors and outages.

The Filter by section controls the scope of the rule. The rule will only check monitors that match the filters defined in this section. In this example, the rule will only alert on browser monitors located in Asia/Pacific - Japan.

Conditions for each rule will be applied to all monitors that match the filters in the Filter by section. You can choose the number of times the monitor has to be down relative to either a number of checks run or a time range in which checks were run, and the minimum number of locations the monitor must be down in.

The Rule schedule defines how often to evaluate the condition. Note that checks are queued, and they run as close to the defined value as capacity allows. For example, if a check is scheduled to run every 2 minutes, but the check takes longer than 2 minutes to run, a check will not run until the previous check has finished.

You can also set Advanced options such as the number of consecutive runs that must meet the rule conditions before an alert occurs.

In this example, the conditions will be met any time a browser monitor is down 3 of the last 5 times the monitor ran across any locations that match the filter. These conditions will be evaluated every minute, and you will only receive an alert when the conditions are met three times consecutively.

Extend your rules by connecting them to actions that use the following supported built-in integrations.

After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour:

Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: the Synthetics monitor status changes or when it is Recovered (went from down to up).

You can also further refine the conditions under which actions run by specifying that actions only run when they match a KQL query or when an alert occurs within a specific time frame:

Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables.

The following variables are specific to this rule type. You an also specify variables common to all rules.

Within the Uptime app, create a Monitor Status rule to receive notifications based on errors and outages.

You can specify the following thresholds for your rule.

Let’s create a rule for any monitor that shows Down more than three times in 10 minutes.

This rule covers all the monitors you have running. You can use a query to specify specific monitors, and you can also have different conditions for each one.

The final step when creating a rule is to select one or more actions to take when the alert is triggered.

You can extend your rules by connecting them to actions that use the following supported built-in integrations. Actions are Kibana services or integrations with third-party systems that run as background tasks on the Kibana server when rule conditions are met.

You can configure action types on the Settings page.

After you select a connector, you must set the action frequency. You can choose to create a summary of alerts on each check interval or on a custom interval. For example, send email notifications that summarize the new, ongoing, and recovered alerts each hour:

Alternatively, you can set the action frequency such that you choose how often the action runs (for example, at each check interval, only when the alert status changes, or at a custom action interval). In this case, you must also select the specific threshold condition that affects when actions run: Uptime Down Monitor or Recovered.

Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables.

To receive a notification when the alert recovers, select Run when Recovered. Use the default notification message or customize it. You can add more context to the message by clicking the icon above the message text box and selecting from a list of available variables.

If you are currently using the Uptime monitor status with a monitor created with Elastic Synthetics, you should migrate the Uptime monitor status rule to:

The KQL syntax that you used in the Uptime monitor status rule is also valid in the Filter by section of the Synthetics monitor status rule. The Synthetics monitor status rule also offers dropdowns for several categories for easy filtering. However, you can still use KQL syntax for these categories if you prefer.

If you’re using the Uptime status check condition, you can recreate similar effects using the following Synthetics monitor status rule condition equivalents:

The default messages for the Uptime monitor status rule and Synthetics monitor status rule are different, but you can recreate similar messages using Synthetics monitor status rule action variables.

SLOs allow you to set clear, measurable targets for your service performance, based on factors like availability. The Synthetics availability SLI is a service-level indicator (SLI) based on the availability of your synthetic monitors.

The KQL syntax that you used in the Uptime monitor status rule is also valid in the Query filter field of the Synthetics availability SLI.

Use the following Synthetics availability SLI fields to replace the Uptime monitor status rule’s availability conditions:

After creating a new SLO using the Synthetics availability SLI, you can use the SLO burn rate rule. For more information about configuring the rule, see Create an SLO burn rate rule.