Kibana 7 Quick Start Guide

Alerting

For alerting, we have watchers that notify us when given conditions are met. The condition can be anything, such as if a field value crosses a certain threshold or if there is an anomaly in the data. In any such condition, we want a notification so that appropriate action can be taken. With the Kibana UI, we can set a watch for any condition, but in the background, we can have a periodic Elasticsearch query that monitors the data and checks whether the given condition is met and acts upon the result. An action could be to send an email, notify a third-party tool such as Slack, or log entry.

Watcher history is maintained in the Elasticsearch index, where we can get the complete information of a watcher, such as when it was executed, ...