Card #2590 · Elastic (Elasticsearch / Kibana)
Kibana Alerting limitations in scheduling and context recovery
Merchants are struggling with the lack of cron-style scheduling in Kibana Alerting, being limited to fixed intervals. Additionally, there are significant issues with alert re-triggering for new entities and a lack of context in recovery notifications, making it difficult to identify which specific host has recovered.
Pain score
0.15/ 1.00 · weighted product of four components
Reach0.32distinct authors (log-normalized)
Recency1.00freshness decay, half-life months
Engagement1.00upvotes + comments, normalized
Monetization0.50willingness-to-pay cues in evidence
§ Evidence — 3 verified quotes
Is there any native way in Kibana Alerting (Stack Alerts, Security Rules, or otherwise) to schedule a rule at a specific clock time (cron-style) rather than a fixed interval? Unfortunately no, they are only interval based.
Once the alert is triggered, it goes into active state. If additional hosts start matching the condition during that time, no new alert is triggered . As a result, newly affected hosts are not reflected in notifications.
when the alert transitions to recovered , the available context variables are very limited. We are not able to reference the original entity (e.g. which host triggered the alert).
Comments are a Pro feature — join the conversation, share what you've shipped, hear what others are building.
Upgrade to Pro