Skip to content

Create alert rules directly from ESQL panel #2165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jul 18, 2025
Merged

Create alert rules directly from ESQL panel #2165

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
260911b
Create alert rules directly from ESQL panel
benironside Jul 17, 2025
255ffd5
Update esorql.md
benironside Jul 17, 2025
ba262a0
Apply suggestions from code review
benironside Jul 17, 2025
6f6a728
Merge branch 'main' into 1710-alerting-rules-from-visualizations
benironside Jul 17, 2025
d03279a
Merge branch 'main' into 1710-alerting-rules-from-visualizations
benironside Jul 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added explore-analyze/images/esql-panel-create-rule.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
29 changes: 28 additions & 1 deletion explore-analyze/visualize/esorql.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ products:

# ES|QL [esql-visualizations]

You can add ES|QL visualizations to a dashboard directly from queries in Discover, or you can start from a dashboard.
You can add {{esql}} visualizations to a dashboard directly from queries in Discover, or you can start from a dashboard.


## Edit and add from Discover [_edit_and_add_from_discover]
Expand Down Expand Up @@ -60,3 +60,30 @@ When editing an {{esql}} visualization, you can customize the appearance of the
![Appearance customization options for ESQL charts](/explore-analyze/images/esql-visualization-customization-options.png)

3. Return to the previous menu, then **Apply and close** the configuration to save your changes.

## Create an alert from your {{esql}} visualization

```{applies_to}
stack: ga 9.1
serverless:
elasticsearch: ga
observability: ga
security: unavailable
```

Once you've created an {{esql}} panel, you can create an {{es}} threshold rule directly from the visualization panel, based on the data it displays. When you do this, the rule query is automatically generated and either describes the data and sets a specific threshold, or describes the data without setting a specific threshold.

::::{note}
{{elastic-sec}} rule types are not supported.
::::
To create a rule with the threshold pre-specified:

- Right-click a data point in the visualization and click **Add alert rule**. This opens the **Create rule** flyout. The generated query will define a threshold that corresponds to the data point you selected.
- [Configure](/solutions/observability/incident-management/create-an-elasticsearch-query-rule.md) your {{es}} rule.

To create a rule without the threshold pre-specified:

- Open the **More actions** (three dots) menu in the upper right of the panel and select **Add alert rule**. This opens the **Create rule** flyout. The generated query will define a threshold that corresponds to the data point you selected.
- [Configure](/solutions/observability/incident-management/create-an-elasticsearch-query-rule.md) your {{es}} rule.


Loading