[Alerting] Allow KQL filtering for all types of aggregations when creating a Custom Threshold Rule by miguelmartin-elastic · Pull Request #248845 · elastic/kibana

miguelmartin-elastic · 2026-01-13T13:35:59Z

Release Notes

Support KQL filtering in all types of aggregations in Custom Threshold Rules

Summary

Before	After

Allow KQL filter to all types of aggregations when creating a Custom Threshold Rule

Alert details page

Filter info added to chart title and tooltip:

Testing

Open the Custom Threshold Rule form
Edit the aggregation A, verify that, when the Count aggregation type is selected, only one input is shown: KQL Filter A, and that it works correctly.
Edit the aggregation A, verify that, when any other aggregation type is selected, two fields are shown: A) Field name and B) KQL Filter A. Verify that both work correctly.
Create different aggregations using different aggregation types and combine them using the Equation field. Verify that it works correctly.

miguelmartin-elastic · 2026-01-13T13:36:10Z

/ci

kibanamachine · 2026-01-13T15:24:47Z

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/648

miguelmartin-elastic · 2026-01-14T15:04:15Z

/ci

kibanamachine · 2026-01-14T16:10:08Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10469

[❌] x-pack/solutions/observability/test/observability_functional/with_rac_write.config.ts: 0/10 tests passed.

see run history

kibanamachine · 2026-01-15T09:42:18Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10478

[❌] x-pack/solutions/observability/test/observability_functional/with_rac_write.config.ts: 0/10 tests passed.

see run history

kibanamachine · 2026-01-15T12:57:18Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10481

[❌] x-pack/solutions/observability/test/observability_functional/with_rac_write.config.ts: 0/10 tests passed.

see run history

kibanamachine · 2026-01-15T14:48:47Z

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10482

[❌] x-pack/solutions/observability/test/observability_functional/with_rac_write.config.ts: 0/10 tests passed.

see run history

miguelmartin-elastic · 2026-01-15T15:55:57Z

/ci

kibanamachine · 2026-01-15T15:59:09Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#10483

[✅] x-pack/solutions/observability/test/observability_functional/with_rac_write.config.ts: 10/10 tests passed.

see run history

elasticmachine · 2026-01-16T10:36:39Z

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

github-actions · 2026-01-16T10:36:45Z

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

/oblt-deploy : Deploy a Kibana instance using the Observability test environments.
run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

benakansara

@miguelmartin-elastic when I try to save rule, I get the following error:

… and test snapshot (#249998) ## Summary This PR is for an intermediate release for #248845 . * Update the Custom Threshold Rule schema to accept an optional KQL string filter as part of the `metrics` items : schema changed from `never` to `optional string` ## Test I tested it manually and verified that Custom Threshold Rules with the new schema in place are executed without issues in current Kibana version in `main`

miguelmartin-elastic · 2026-01-29T11:26:54Z

hey @pmuellr , the intermediate release for this PR was already deployed to serverless in 6f03fc5236af. Are we good to go from your side?

pmuellr · 2026-01-29T22:00:42Z

the intermediate release for this PR was already deployed to serverless in 6f03fc5236af. Are we good to go from your side?

Looks like that was merged late-ish on Friday. We should double-check it made it into this week's build - I'll have to figure out how :-)

pmuellr · 2026-01-29T22:08:39Z

Ya, it did make it into this week's build (git commit is now written in all kinds of messages \o/ ), you should be good to go!

benakansara

Overall LGTM!

Could we include filter information on the chart title on alert details page?

miguelmartin-elastic · 2026-02-02T12:30:52Z

filter info added to the title and tooltip @benakansara ✅

pmuellr

ResponseOps changes to move to an intermediate release for this PR LGTM.

elasticmachine · 2026-02-03T18:52:55Z

Pinging @elastic/actionable-obs-team (Team:actionable-obs)

benakansara

LGTM

elasticmachine · 2026-02-05T18:18:39Z

⏳ Build in-progress

Buildkite Build
Commit: 94b4028
Cloud Deployment
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-248845-94b40285b406

Failed CI Steps

FTR Configs #52

Test Failures

[job] [logs] FTR Configs #52 / Endpoint plugin @ess @serverless @skipInServerlessMKI Endpoint policy response api GET /api/endpoint/policy_response "before all" hook for "should return one policy response for an id"

History

💔 Build #390479 failed e4a1ef1
💛 Build #390115 was flaky 5d25c3b
💔 Build #390099 failed d3e673a
💚 Build #388613 succeeded 8c36fa0
💔 Build #388594 failed ac8f48d

add kql filter to all aggs

2f33e0f

github-actions Bot added the author:actionable-obs PRs authored by the actionable obs team label Jan 13, 2026

miguelmartin-elastic added backport:skip This PR does not require backporting ci:cloud-deploy Create or update a Cloud deployment labels Jan 13, 2026

miguelmartin-elastic changed the title ~~[Alerting] Allow KQL filter to all types of aggregations when creating a Custom Threshold Rule~~ [Alerting] Allow KQL filtering for all types of aggregations when creating a Custom Threshold Rule Jan 13, 2026

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

2736185

await for popover to disappear

40e0f07

fix(test): retry close popover

e45c202

miguelmartin-elastic marked this pull request as ready for review January 16, 2026 10:35

miguelmartin-elastic requested a review from a team as a code owner January 16, 2026 10:35

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

7229945

botelastic Bot added ci:project-deploy-observability Create an Observability project Team:obs-ux-management labels Jan 16, 2026

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

3731278

miguelmartin-elastic added the release_note:enhancement label Jan 19, 2026

miguelmartin-elastic added 2 commits January 20, 2026 09:59

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

6c3df8b

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

c10a2c3

benakansara reviewed Jan 20, 2026

View reviewed changes

update custom threshold rule backend validation schema

c51e695

miguelmartin-elastic and others added 4 commits January 26, 2026 17:24

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

730981d

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

94d6b57

Changes from yarn openapi:bundle

40b56d6

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

6c0cf3d

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

a9adc86

benakansara reviewed Jan 30, 2026

View reviewed changes

miguelmartin-elastic requested a review from pmuellr January 30, 2026 14:29

miguelmartin-elastic added 2 commits February 2, 2026 12:29

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

e278c7f

add filter info in char title and tooltip

ac8f48d

Changes from node scripts/eslint_all_files --no-cache --fix

8c36fa0

pmuellr removed their request for review February 2, 2026 15:12

pmuellr approved these changes Feb 3, 2026

View reviewed changes

miguelmartin-elastic added the Team:actionable-obs Formerly "obs-ux-management", responsible for SLO, o11y alerting, significant events, & synthetics. label Feb 3, 2026

benakansara reviewed Feb 4, 2026

View reviewed changes

Comment thread ...m_threshold/components/alert_details_app_section/helpers/generate_chart_title_and_tooltip.ts Outdated

miguelmartin-elastic and others added 2 commits February 4, 2026 19:05

commmit suggestion: use CustomThresholdExpressionMetric

d3e673a

Changes from node scripts/eslint_all_files --no-cache --fix

5d25c3b

benakansara approved these changes Feb 4, 2026

View reviewed changes

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

e4a1ef1

miguelmartin-elastic enabled auto-merge (squash) February 5, 2026 14:56

Merge branch 'main' into 231158-Add-kql-filtering-custom-rule

94b4028

miguelmartin-elastic merged commit 05a94f6 into elastic:main Feb 5, 2026
16 checks passed

kibanamachine added the v9.4.0 label Feb 5, 2026

miguelmartin-elastic mentioned this pull request Apr 13, 2026

[Internal]: [Alerting][9.4] Custom Threshold Rule: KQL filtering now available for all aggregation types elastic/docs-content#5871

Closed

Conversation

miguelmartin-elastic commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Summary

Alert details page

Testing

Uh oh!

miguelmartin-elastic commented Jan 13, 2026

Uh oh!

kibanamachine commented Jan 13, 2026

Uh oh!

miguelmartin-elastic commented Jan 14, 2026

Uh oh!

kibanamachine commented Jan 14, 2026

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10469

Uh oh!

kibanamachine commented Jan 15, 2026

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10478

Uh oh!

kibanamachine commented Jan 15, 2026

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10481

Uh oh!

kibanamachine commented Jan 15, 2026

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#10482

Uh oh!

miguelmartin-elastic commented Jan 15, 2026

Uh oh!

kibanamachine commented Jan 15, 2026

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#10483

Uh oh!

elasticmachine commented Jan 16, 2026

Uh oh!

github-actions Bot commented Jan 16, 2026

🤖 GitHub comments

Uh oh!

benakansara left a comment

Choose a reason for hiding this comment

Uh oh!

miguelmartin-elastic commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pmuellr commented Jan 29, 2026

Uh oh!

pmuellr commented Jan 29, 2026

Uh oh!

benakansara left a comment

Choose a reason for hiding this comment

Uh oh!

miguelmartin-elastic commented Feb 2, 2026

Uh oh!

pmuellr left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Feb 3, 2026

Uh oh!

Uh oh!

benakansara left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ Build in-progress

Failed CI Steps

Test Failures

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

miguelmartin-elastic commented Jan 13, 2026 •

edited

Loading

miguelmartin-elastic commented Jan 29, 2026 •

edited

Loading

elasticmachine commented Feb 5, 2026 •

edited

Loading