Monitor alerts on Grafana Labs

Alerts overview page

Fri, 03 Apr 2026 12:35:46 -0500

Note
Alerts page is currently in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

Alert view

Grafana Alerting provides a consolidated snapshot of your firing and pending Grafana-managed alerts in a simplified view. For users with complex deployments, it can be difficult to monitor and prioritize critical incidents among a large volume of firing or pending alerts. With the Alert page, you have a view where you can quickly explore and sort your recent alert history and see what alerts require review or action.

To see your firing and pending alerts in the alert page, go to Alerts & IRM > Alerting > Alerts.

How it works

The Alerts page only shows alerts from Grafana-managed alert rules. Grafana uses a metric called GRAFANA_ALERTS, which is recorded in the default Mimir data source that is provisioned for cloud users.

Note
OSS users need to manually configure this. To configure alert state history for OSS, refer to the configure Loki and Prometheus for alert state documentation.

Filter alerts in the Alerts page

The page displays the count of alert rules and instances that are both firing and pending. Use the filters to group your alerts and find specific alerts by label.

To group alerts by label, click the Group by field and select the labels from the dropdown menu. You can select multiple labels for alert grouping.

To filter by specific label values, click the Filters field and select a label to filter by, followed by an expression of what label value you want to use. You can enter multiple label values in your search.

You can also select a time range from the time picker to further adjust your results. Click the time range field and enter an absolute time range or select a period from the quick ranges list to apply a new time window to the display results.

View alert rules

Fri, 03 Apr 2026 12:35:46 -0500

View alert rules

The Alert rules list view page lists all existing recording and alert rules, including those created in Grafana and those available in configured data sources.

To access the Alert rules page, click Alerts & IRM -> Alerting -> Alert rules.

By default, alert rules are grouped in separate sections—one for Grafana-managed alerts, and another for data source-managed alerts. Inside the Grafana-managed alert rules section, the rules are organized in a hierarchical structure, from folder -> rule group -> rules. Inside the data source-managed alert rules section, the rules are organized from namespace ->rule group -> rules.

Select a group to expand it and view the list of alert rules within that group.

The list view includes a number of filters to simplify managing large volumes of alerts.

Filter and save searches

Click the Filter button to open the filter popup. You can filter by name, label, folder/namespace, evaluation group, data source, contact point, rule source, rule state, rule type, and the health of the alert rule from the popup menu. Click Apply at the bottom of the filter popup to enact the filters as you search.

Click the Saved searches button to open the list of previously saved searches, or click + Save current search to add your current search to the saved searches list. You can also rename a saved search or set it as a default search. When you set a saved search as the default search, the Alert rules page opens with the search applied.

Change alert rules list view

You can also change how the rule list is displayed using the View as option.

Grouped: Displays Grafana rules grouped in a hierarchical structure, from folder/namespace, to evaluation group, to the individual rules. This is the default view.
List: Displays all rules from all data sources in a flat, unpaginated list.

For details on how rule states and alert instance states are displayed, refer to View alert state.

View, compare and restore alert rules versions.

You can view, compare, and restore previous alert rule versions.

Note
In Grafana OSS and Enterprise, the number of alert rule versions is limited. Free users are allowed a maximum of 10 alert rule versions, while paid users have a maximum of 100 stored alert rule versions.

To view or restore previous versions for an alert rule, complete the following steps.

Navigate to Alerts & IRM -> Alerting -> Alert rules.
Select an alert rule and click View.
Click the Versions tab.
The page displays a list of the previous rule versions.

On the Alert rule’s Versions page you can view, compare and restore the previous rule versions.

Bulk pause or resume alert rules evaluations within a folder

Admin users can pause or resume all of the alert rules evaluations within a folder. To pause or resume all the alert rules evaluations in a folder, click the menu icon and select Pause all rule evaluation or Resume all rule evaluation.

Bulk delete all alert rules within a folder

Admin users can delete all of the alert rules within a folder. To delete all the alert rules in a folder, click the menu icon and select Delete. Then type “Delete” into the field and click Delete to confirm the bulk deletion.

Permanently delete or restore deleted alert rules

Only users with an Admin role can restore deleted Grafana-managed alert rules. After an alert rule is restored, it is restored with a new, different UID from the one it had before.

Go to Alerts & IRM -> Alerting -> Recently deleted.
Click the Restore button to restore the alert rule or click Delete permanently to delete the alert rule.

Note
Deleted alert rules are stored for 30 days. Grafana Enterprise and OSS users can adjust the length of time for which the rules are stored can be adjusted in the Grafana configuration file’s [unified_alerting].deleted_rule_retention field. For an example of how to modify the Grafana configuration file, refer to the documentation example here.

View alert state

Fri, 03 Apr 2026 12:35:46 -0500

View alert state

An alert rule and its corresponding alert instances can transition through distinct states during the alert rule evaluation.

There are three key components that helps us understand the behavior of our alerts:

Alert Instance State: Refers to the state of the individual alert instances.
Alert Rule State: Determined by the “worst state” among its alert instances.
Alert Rule Health: Indicates the status in cases of Error or NoData events.

View alert rule and instance states

To view the details of your alert rules and the status of alert instances:

Click Alerts & IRM -> Alerting.
Click Alert rules to view the list of existing alert rules.

Each alert rule shows its state, summary, and available actions such as Pause evaluation, Silence notifications, Export, Delete, and more.
Click on an alert rule to view additional details and its resulting alert instances.

View from the alert rule details page

To view more alert rule details, complete the following steps.

Click Alerts & IRM -> Alerting -> Alert rules.
Click to expand an alert rule.
Click the alert name to go to the alert details view.

The namespace and group are shown in the breadcrumb navigation. They are interactive and can be used to filter rules by namespace or group.

The rest of the alert detail content is split up into tabs:

Query and conditions

View the details of the query that is used for the alert rule, including the expressions and intermediate values for each step of the expression pipeline. A graph view is included for range queries and data sources that return time series-like data frames.

Instances

Explore each alert instance, its status, labels and various other metadata for multi-dimensional alert rules.

Use Search by label to enter search criteria using label selectors. For example, environment=production,region=~US|EU,severity!=warning.

History

Explore the recorded history for an alert rule. You can also filter by alert state.

Details

Debug or audit using the alert rule metadata and view the alert rule annotations.

View alert state on panels

When an alert rule is linked to a time series panel, the time series panel displays the alert state and alert events.

A heart icon near the panel title shows the current alert state:

A broken red heart when the alert is in Alerting state.
A green heart when the alert is in Normal state.

Colored annotations indicate changes in alert state, such as pending, alerting, and resolving.

Additionally, Grafana provides an alert list panel that you can add to a dashboard to display a list of alerts and their states.

You can configure the alert list panel with various visualization options and filters to control how alerts are displayed. For more details, refer to the Alert list documentation.

Give it a try using Grafana Play

With Grafana Play, you can explore and see how it works, learning from practical examples to accelerate your development. This feature can be seen on this demo dashboard with alert list panels and linked alert rules.

Try it

View alert state history

Fri, 03 Apr 2026 12:35:46 -0500

View alert state history

View a history of all alert events generated by your Grafana-managed alert rules from one centralized page. This helps you see patterns in your alerts over time, observe trends, make predictions, and even debug alerts that might be firing too often.

An alert event is displayed each time an alert instance changes its state over a period of time. All alert events are displayed regardless of whether silences or mute timings are set, so you’ll see a complete set of your data history even if you’re not necessarily being notified.

Note
Grafana OSS and Grafana Enterprise users must configure alert state history in Loki to view the History page and State history view.

View from the History page

The History page shows the history and state changes of all Grafana-managed alert rules. You can filter by labels and alert states.

Users can only view the history of alert rules they have permission to access (RBAC).

Note
Grafana OSS and Grafana Enterprise users must also enable the alertingCentralAlertHistory feature toggle to access this page.

To access the History page, complete the following steps.

Navigate to Alerts & IRM -> Alerting -> History.

An Alert Events chart shows your alert activity within a specific time frame. Each alert event represents an alert instance that changed its state at a particular point in time. The history of the data is displayed over a period of time.
Filter by labels either by entering a label or clicking a label of an instance in the list of events.
Filter by current state and previous state by selecting a state from the drop-down or by clicking the states from the list of events. Zoom in by dragging on the chart or use the time picker.

Note
If you exceed the 5000 alerts limit, you may see data missing from the chart. To see complete results, narrow the time frame.
Under the chart, there is a list of events. Each event represents a state change on an alert instance. Expand a row to see the number of transitions for the alert instance, a state graph, and the value in the transition.
Click the alert rule name to jump to the History tab in the Alert Rule view.

Use Grafana Assistant to analyze alert state history

Note
This feature is available in Grafana Cloud when Grafana Assistant is enabled.

The Analyze with Assistant button provides AI-powered analysis of your alert history to help you understand and troubleshoot alert patterns. Located in the top-right corner of the History page event list, this button uses Grafana Assistant to analyze the events displayed in your current view.

When you click the AI Triage button, the Grafana Assistant analyzes:

Alert state transitions over the selected time range
Alert instance patterns and frequency
Common labels and characteristics of firing alerts
Temporal patterns in alert behavior

The AI assistant can help you:

Identify root causes of alert storms
Detect patterns in alert firing behavior
Understand correlations between different alert instances
Get suggestions for improving alert configurations

To use the Analyze with Assistant feature:

Navigate to the History page as described above.
Filter the events to focus on the alerts you want to analyze using labels, states, or time range.
Click the Analyze with Assistant button in the top-right corner of the event list.
Review the AI-generated analysis and recommendations.

The AI analysis is based on the currently displayed events, so filtering your view to specific alerts or time periods will result in more focused insights.

View from the State history view

Use the State history view to get insight into how your individual alert instances behave over time.

View information on when a state change occurred, what the previous state was, the current state, any other alert instances that changed their state at the same time as well as what the query value was that triggered the change.

To access the State history view, complete the following steps.

Navigate to Alerts & IRM -> Alerting -> Alert rules.
Click an alert rule.
Select Show state history.

The timeline view at the top displays a timeline of changes for the past hour, so you can track how your alert instances are behaving over time.

The bottom part shows the alert instances, their previous and current state, the value of each part of the expression and a unique set of labels.

Common labels are displayed at the top to make it easier to identify different alert instances.
From the timeline view, hover over a time to get an automatic display of all the changes that happened at that particular moment.

These changes are displayed in real time in the timestamp view at the bottom of the page. The timestamp view is a list of all the alert instances that changed state at that point in time. The visualization only displays 12 instances by default.

The value shown for each instance is for each part of the expression that was evaluated.
Click the labels to filter and narrow down the results.

Explore and query the alert history

You can also use Grafana Explore to query the data sources that store alert history.

For details on querying these data sources, refer to Alerting Meta monitoring.

View active notifications

Fri, 03 Apr 2026 12:35:46 -0500

View active notifications

The Active notifications page lists groups of alerts (or alert instances) that are actively triggering notifications.

By default, Grafana Alerting groups similar alerts into a single notification.

In this view, you can:

Find alert groups and the state of their notifications.
Filter for alert instances that match specific criteria.

The Active notifications view is useful for debugging and verifying how notifications are grouped based on your notification policy settings.

View alert groups and notification state

To view alert groups, complete the following steps.

Click Alerts & IRM -> Alerting.
Click Active notifications to view the list of groups firing notifications.

By default, alert groups are grouped by the notification policies grouping.

Each group displays its label set, contact point, and the number of alert instances (or alerts).

Then, click on a group to access its alert instances. You can find alert instances by their label set and view their notification state.

Notification states

The notification state of an alert instance can be in one of the following states:

Unprocessed: The alert is received but its notification has not been processed yet.
Suppressed: The alert has been silenced.
Active: The alert notification has been handled. The alert is still firing and continues to be managed.

Filter alerts

You can filter by label, state, or Alertmanager:

By label: In Search, enter an existing label to view alerts matching the label. For example, environment=production,region=~US|EU,severity!=warning.
By state: In States, select from Active, Suppressed, or Unprocessed states to view alerts matching your selected state. All other alerts are hidden.
By Alertmanager: In the Alertmanager dropdown, select an external Alertmanager to view only alert groups for that specific Alertmanager. By default, the Grafana Alertmanager is selected.

Custom group

From Custom group by dropdown, select a combination of labels to view a grouping other than the default. This helps validate the grouping settings of your notification policies.

If an alert does not contain labels specified either in the grouping of the default policy or the custom grouping, then the alert is added to a catch all group with a header of No grouping.

View notification errors

Note
Notification errors are only available with pre-configured Grafana Alertmanagers.

Notification errors provide information about why they failed to be sent or were not received.

To view notification errors, navigate to Alerts & IRM -> Alerting -> Contact points.

Each contact point displays a message about the status of their latest notification deliveries.

If a contact point is failing, a red message indicates that there are errors delivering notifications. Hover over the error message to see the notification error details.

Declare incidents from firing alerts

Fri, 03 Apr 2026 12:35:46 -0500

Declare incidents from firing alerts

Declare an incident from a firing alert to streamline your alert to incident workflow.

Before you begin

Ensure you have Grafana Incident installed.
You must have a firing alert.

Procedure

To declare an incident from a firing alert, complete the following steps.

Navigate to Alerts & IRM -> Alerting -> Alert rules.
From the Alert rules page, click the Firing filter to display firing alerts. Find the firing alert that you want to declare an incident for.
Click More -> Declare Incident.

Alternatively, you can declare an incident from the Alert details page.

The Declare Incident pop-up opens in the Grafana Incident application.
In the Declare Incident pop-up, enter the What’s going on? field.

This field is pre-filled with the name of the alert rule, but you can edit it as required.

The alert rule is also linked to the incident.
Select a severity.
Add labels, as required.
Click More options to include a channel prefix and status.
Click Automated options to enable automated actions configured by admins.
Click Declare Incident.

Next steps

View and manage the incident in the Grafana Incident application.

For more information, refer to the Grafana Incident documentation.