elastic / elastic/docs-content

[Alerting V2] Unified alerts table (v1 + v2 alerts)

Open
#8,226 1 comment 0 reactions 1 assignee Claimed by @nastasha-solomon View on GitHub
alerting-v2 documentation Team:SKI
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 21h
Merged PRs (30d)
141

Description

## Summary
The Alerting v2 episodes table now displays both classic (v1) and new (v2) alerts in a unified inbox experience. This provides users with a single place to view, manage, and triage all their alerts regardless of which alerting system generated them.

## New Feature: Unified Alerts Table
- **Location**: Stack Management > Alerts page (initial release), with plans to expand to Observability solution pages
- **Purpose**: Displays both classic alerts (v1) and new alerting episodes (v2) in a single unified table
- **User Benefit**: Users no longer need to navigate to different pages to see alerts from different alerting systems

## Key Capabilities

#### Viewing Alerts
- **Unified table** shows both v1 and v2 alerts side-by-side
- **Filtering**:
- By status
- By severity
- By rule
- By tags
- Search with query string syntax (e.g., `kibana.alert.rule.name: "my rule"`)
- **Note**: Searching by v2-specific fields (e.g., `episode.status`) won't find matching v1 alerts due to different field naming
- **KPIs panel** shows aggregate metrics across both alert types:
- Total alerts count
- Firing rules count
- Acknowledged count
- Snoozed count
- **Histogram** visualizes alert activity over time for both v1 and v2 alerts

#### Alert Details
- **Classic alerts (v1)**: Show in a simplified flyout with alert details, metadata, and available actions
- **New alerts (v2)**: Show in the full timeline flyout with event history and lifecycle visualization
- **Different flyout experiences** based on alert type to match the underlying data model
- **Note**: Classic alert (v1) actions are limited to viewing details in the current phase.

## Technical Context

#### RBAC (Role-Based Access Control)
- Classic alerts (v1) leverage the existing v1 RBAC system
- Users only see v1 alerts for rule types they have read access to
- Server-side filtering ensures proper authorization

#### Supported Classic Rule Types (v1)
Alerts from the following classic rule types are currently shown in the unified alerts table:

**Observability rules:**
- `observability.rules.custom_threshold`
- `slo.rules.burnRate`
- `apm.error_rate`
- `apm.transaction_error_rate`
- `apm.transaction_duration`
- `apm.anomaly`
- `xpack.synthetics.alerts.monitorStatus`
- `xpack.synthetics.alerts.tls`
- `xpack.uptime.alerts.tls`
- `xpack.uptime.alerts.tlsCertificate`
- `xpack.uptime.alerts.monitorStatus`
- `xpack.uptime.alerts.durationAnomaly`
- `metrics.alert.threshold`
- `metrics.alert.inventory.threshold`
- `logs.alert.document.count`

**Stack Management rules:**
- `.es-query`
- `.index-threshold`
- `.geo-containment`
- `transform_health`
- `xpack.ml.anomaly_detection_alert`

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.