elastic / elastic/docs-content
[Alerting V2] Unified alerts table (v1 + v2 alerts)
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 21h
- Merged PRs (30d)
- 141
Description
## Summary
The Alerting v2 episodes table now displays both classic (v1) and new (v2) alerts in a unified inbox experience. This provides users with a single place to view, manage, and triage all their alerts regardless of which alerting system generated them.
## New Feature: Unified Alerts Table
- **Location**: Stack Management > Alerts page (initial release), with plans to expand to Observability solution pages
- **Purpose**: Displays both classic alerts (v1) and new alerting episodes (v2) in a single unified table
- **User Benefit**: Users no longer need to navigate to different pages to see alerts from different alerting systems
## Key Capabilities
#### Viewing Alerts
- **Unified table** shows both v1 and v2 alerts side-by-side
- **Filtering**:
- By status
- By severity
- By rule
- By tags
- Search with query string syntax (e.g., `kibana.alert.rule.name: "my rule"`)
- **Note**: Searching by v2-specific fields (e.g., `episode.status`) won't find matching v1 alerts due to different field naming
- **KPIs panel** shows aggregate metrics across both alert types:
- Total alerts count
- Firing rules count
- Acknowledged count
- Snoozed count
- **Histogram** visualizes alert activity over time for both v1 and v2 alerts
#### Alert Details
- **Classic alerts (v1)**: Show in a simplified flyout with alert details, metadata, and available actions
- **New alerts (v2)**: Show in the full timeline flyout with event history and lifecycle visualization
- **Different flyout experiences** based on alert type to match the underlying data model
- **Note**: Classic alert (v1) actions are limited to viewing details in the current phase.
## Technical Context
#### RBAC (Role-Based Access Control)
- Classic alerts (v1) leverage the existing v1 RBAC system
- Users only see v1 alerts for rule types they have read access to
- Server-side filtering ensures proper authorization
#### Supported Classic Rule Types (v1)
Alerts from the following classic rule types are currently shown in the unified alerts table:
**Observability rules:**
- `observability.rules.custom_threshold`
- `slo.rules.burnRate`
- `apm.error_rate`
- `apm.transaction_error_rate`
- `apm.transaction_duration`
- `apm.anomaly`
- `xpack.synthetics.alerts.monitorStatus`
- `xpack.synthetics.alerts.tls`
- `xpack.uptime.alerts.tls`
- `xpack.uptime.alerts.tlsCertificate`
- `xpack.uptime.alerts.monitorStatus`
- `xpack.uptime.alerts.durationAnomaly`
- `metrics.alert.threshold`
- `metrics.alert.inventory.threshold`
- `logs.alert.document.count`
**Stack Management rules:**
- `.es-query`
- `.index-threshold`
- `.geo-containment`
- `transform_health`
- `xpack.ml.anomaly_detection_alert`
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.