Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Write troubleshooting docs for max alerts warning #3262

Merged
merged 12 commits into from
May 22, 2023
Merged
8 changes: 8 additions & 0 deletions docs/detections/rules-ui-monitor.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,14 @@ You can also use Task Manager in {kib} to troubleshoot background tasks and proc
* {kibana-ref}/task-manager-health-monitoring.html[Task Manager health monitoring]
* {kibana-ref}/task-manager-troubleshooting.html[Task Manager troubleshooting]

[float]
[[troubleshoot-max-alerts]]
==== Troubleshoot maximum alerts warning

When a rule reaches the maximum number of alerts it can generate during a single rule execution, the following warning appears on the rule's details page and in the rule execution log: `This rule reached the maximum alert limit for the rule execution. Some alerts were not created.`

If you receive this warning, go to the rule's **Alerts** tab and check for anything unexpected. Unexpected alerts might be created from data source issues or queries that are too broadly scoped. To further reduce alert volume, you can also add <<add-exceptions,rule exceptions>> or <<alert-suppression,suppress alerts>>.

[float]
[[troubleshoot-gaps]]
==== Troubleshoot gaps
Expand Down