elastic / elastic/docs-content
[Alerting V2][M3] Trigger workflows from rule execution outcomes (events generated, execution failed)
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 21h
- Merged PRs (30d)
- 141
Description
## Summary
Two new workflow trigger types let a workflow react directly to a rule's own execution outcome, rather than only to alert episode state changes: `alerting.ruleEventsGenerated` fires whenever a rule's evaluation produces one or more rule events, and `alerting.ruleExecutionFailed` fires when a rule's evaluation throws an error. Each trigger's payload carries rule and execution context (rule ID/tags, scheduled time, event count or error details), and a workflow can query the underlying `.rule-events` data stream with ES|QL for finer-grained processing of that run's events.
**Why this needs docs:** This introduces a new trigger category — rule-execution triggers — alongside the already-documented alert-episode lifecycle triggers, and the current docs don't mention it.
## Resources
- PR [#279147](https://github.com/elastic/kibana/pull/279147) — [Alerting v2] Rule execution workflow triggers
- Product issue: https://github.com/elastic/rna-program/issues/515
## Availability
| Channel | Details |
|---------|---------|
| **Stack** | v9.6.0 |
| **Serverless** | Jul 20–Jul 27 |
| **Feature status** | Technical preview |
| **Feature flag** | Requires the Alerting v2 preview to be enabled |
---
*Created with [Docs Quest Scanner](https://github.com/florent-leborgne/docs-quest-scanner) by @nastasha-solomon*
## Suggested edits
[Notifications and actions for the experimental alerting system](https://www.elastic.co/docs/explore-analyze/alerting/experimental-alerting-system/notifications-actions) > Send notifications or trigger an action
- **What the docs say:** "For actions that fire exactly once in response to a specific alert episode event (such as opening a ticket when an episode is assigned) use an alert episode lifecycle trigger instead of an action policy."
- **What to add:** Add a mention of rule-execution triggers (`alerting.ruleEventsGenerated`, `alerting.ruleExecutionFailed`) as a third automation surface, distinct from alert episode lifecycle triggers — these fire on the rule's own execution outcome rather than an alert episode's lifecycle event, useful for cases like notifying engineers when a detection rule itself breaks. Applies from 9.6.0 (technical preview) and in serverless.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.