› › ›

Maintenance windows

[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

This content applies to:

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.

Alerts continue to be generated, however notifications are suppressed as follows:

When an alert occurs during a maintenance window, there are no notifications. When the alert recovers, there are no notifications—even if the recovery occurs after the maintenance window ends.
When an alert occurs before a maintenance window and recovers during or after the maintenance window, notifications are sent as usual.

Create and manage maintenance windows

edit

In Project settings → Management → Maintenance Windows you can create, edit, and archive maintenance windows.

When you create a maintenance window, you must provide a name and a schedule. You can optionally configure it to repeat daily, monthly, yearly, or on a custom interval.

The Create Maintenance Window user interface in Kibana

If you turn on Filter alerts, you can use KQL to filter the alerts affected by the maintenance window. For example, you can suppress notifications for alerts from specific rules:

The Create Maintenance Window user interface in Kibana with a filter

You can select only a single category when you turn on filters.
Some rules are not affected by maintenance window filters because their alerts do not contain requisite data. In particular, Stack Monitoring, tracking containment, anomaly detection jobs health, and transform health rules are not affected by the filters.

A maintenance window can have any one of the following statuses:

Upcoming: It will run at the scheduled date and time.
Running: It is running.
Finished: It ended and does not have a repeat schedule.
Archived: It is archived. In a future release, archived maintenance windows will be queued for deletion.

When you view alert details in Kibana, each alert shows unique identifiers for maintenance windows that affected it.

« Machine learning Maps »