Unified Alerts View

The Unified Alerts View (labeled Alerts in the OpenSearch Dashboards side navigation) brings every alert in the stack into a single screen and is where you create new alert rules. Whether an alert came from an OpenSearch log query or a Prometheus metric, responders see it in one list, filter it the same way, and never have to know which engine produced it.

The three tabs

Tab	What it shows	Where to read more
Alerts	Every currently firing (and, where available, historical) alert across the selected data sources.	Explore Alerts
Rules	Every rule definition (plus the anomaly detectors and forecasters defined elsewhere), with status, severity, type, and health. Also where you create rules.	Create Rules · Explore Rules
Routing	The Prometheus Alertmanager routing tree — which receiver each metric alert is sent to.	Routing

Rule types

The Rules tab lists every alerting rule from both engines side by side. The Type facet classifies each by the data it runs on:

Type	Runs on	Written in
Log	OpenSearch indices — logs and traces	PPL
Metric	Prometheus time series	PromQL
APM	Trace/span data (classic monitors)	Query DSL
Cluster Metrics	OpenSearch cluster health (classic monitors)	API calls

The two you create in this view are log rules and metric rules — those are the only types the Create alert rule button builds. See Create Rules to build one. APM and Cluster Metrics rules also appear here but are classic monitors created in the standalone Alerting app.

The catalog also surfaces the anomaly detectors and forecasters you define elsewhere in the stack, so their alerts sit alongside your rules. Set those up in Anomaly Detection and Forecasting.

In this section

Create Rules Build log rules (PPL) and metric rules (PromQL), with step-by-step walkthroughs and examples.

Notifications Route firing alerts to Slack, email, PagerDuty, and webhooks.

Explore Alerts Triage what's firing — filter the alert list, read the severity timeline, and scope data sources.

Explore Rules Browse the rules catalog by type, status, and health.

Routing View the live Prometheus Alertmanager route tree and receivers.

Classic monitors (previous experience)

The Unified Alerts View is the new, default alerting experience. If you’re coming from the older OpenSearch Alerting UI, choose Switch to the classic experience in the banner to return to the standalone Alerting app.

The classic app offers monitor types that the log-rule form doesn’t cover, defined with a visual editor or an extraction (query DSL) query rather than PPL:

Classic type	Best for	Modern equivalent
Per-query	A single threshold check on aggregation results	Log rule: stats + custom condition
Per-bucket	One alert per group (e.g. per service)	Log rule: stats ... by <field> + custom condition
Per-document	Alerting on individual matching documents, with findings	— (use classic)
Per-cluster metrics	Watching OpenSearch cluster health via API calls	— (use classic)
Composite	Chaining monitors with workflow logic to reduce noise	— (use classic)

For most observability use cases a PPL log rule is faster to write and read than a per-query or per-bucket monitor. Reach for the classic app when you need per-document, per-cluster metrics, or composite monitors. Rules created either way surface together in this view, tagged by type. For the full classic reference, see the OpenSearch Alerting documentation.

Related

• Alerting Overview — how log rules and metric rules fit together.
• SLOs — SLO burn-rate alerts surface here as metric rules.
• PPL — Query Language — the language behind log rules.