Explore Rules

The Rules tab of the Unified Alerts View is the catalog of everything that can fire: every alerting rule from both engines, plus the anomaly detectors and forecasters you define elsewhere, side by side. Where the Alerts tab shows what’s firing now, the Rules tab shows what’s defined.

The rules catalog

Each row shows a rule’s name, status, severity, type, health, and owning data source. Filter by any facet to answer questions like “which log rules are unhealthy?” or “show me every critical metric rule on the Prometheus data source.”

The Type facet classifies each rule by the data it runs on — Log, Metric, APM, Cluster Metrics. See Rule types for what each one means. To add a rule from here, use Create alert rule — see Create Rules.

Which types you can create here

Create alert rule builds Log and Metric rules only. APM and Cluster Metrics rules also appear in this catalog and can be filtered on, but they are classic monitors — created in the standalone Alerting app, not from the Create alert rule button.

Inspect and manage a rule

Select a rule to open its detail panel. It shows the rule’s query definition, conditions & evaluation (evaluation interval, pending period, threshold), labels, a condition preview, and its recent alerts — everything you need to understand why a rule is (or isn’t) firing.

The panel’s toolbar carries the lifecycle actions:

Action	What it does
Edit	Change the query, schedule, conditions, or notification actions.
Clone	Duplicate the rule as a starting point for a similar one.
Disable rule / Enable	Stop or resume evaluation without deleting the rule — the fastest way to quiet a noisy rule while you tune it.
Delete	Remove the rule permanently.

Silence vs. disable

Disable stops a rule from evaluating at all. To keep a metric rule running but stop its notifications temporarily, use an Alertmanager silence instead — see Notifications.

Filters

The left rail is shared with the Alerts tab and scopes the catalog the same way:

• Datasource — the OpenSearch cluster, the Prometheus data source, or both.
• Severity — critical, high, medium, and so on.
• Type — Log, Metric, APM, Cluster Metrics.
• Labels — filter to one service, exporter, or component in a click.

Empty catalog

If the Rules tab is empty, there are no rules for the selected data sources yet. Confirm the right data sources are selected in the filter, or create a rule.

Related

• Explore Alerts — triage the alerts these rules produce.
• Create Rules — build log and metric rules.
• Routing — the Prometheus Alertmanager route tree for metric alerts.
• Unified Alerts View — overview, rule types, and classic monitors.