Building alerts from the ML UI

With the release of v7.12, Elastic ML changed its default alert handler from Watcher to Kibana alerting. Prior to v7.12, the user had a choice of accepting a default watch (an instance of a script for Watcher) if alerting was selected from the ML UI, or the user could create a watch from scratch. This section will focus on the new workflow using Kibana alerting as of v7.12, which offers a nice balance of flexibility and ease of use.

To create a working, illustrative example of real-time alerting, we will contrive a scenario using the Kibana sample web logs dataset that we first used in Chapter 3, Anomaly Detection.

The process outlined in this section will be as follows:

1. Define some sample anomaly detection jobs on the sample data.
2. Define two alerts on two of the anomaly detection jobs.
3. Run a simulation of anomalous behavior, to catch that behavior in an alert.

Let's first define the sample anomaly detection jobs.

...