Rule-based alerting on Elasticsearch and OpenSearch data: queries indices on a schedule and sends matches to email, Slack, PagerDuty and many other outputs.
Pricing and hosting
- Pricing
- Free
- Open source
- Yes (Apache-2.0)
- Self-hosted
- Yes
- Launched
- 2020
- Status
- Active
- Website
- elastalert2.readthedocs.io
Plans and prices change; check the tool's own site before you decide.
What it does
Alert routing and correlation checklist
4 of 10 confirmed in ElastAlert 2's own documentation. The same checklist is used for every tool in Alert routing.
- Many alert sources No
- Deduplication Yes
- Grouping or correlation Yes
- Silences or maintenance Not confirmed
- Routing rules Not confirmed
- Inhibition or dependencies Not confirmed
- Enrichment Yes
- Hands off to on-call Yes
- Alert console No
- Two-way sync Not confirmed
Rule engine over Elasticsearch/OpenSearch data, not an alert aggregator; dedup via realert, grouping via aggregation; no UI
Checked against: github.com, elastalert2.readthedocs.io, elastalert2.readthedocs.io (2)
Alternatives to ElastAlert 2
Other alert routing and correlation tools. See all 9.
-
Alerta Self-hosted alert console that collects alerts from Prometheus, Nagios, Zabbix, CloudWatch and others, deduplicates and correlates them, and shows them in one web UI with an API and CLI. -
BigPanda Event correlation platform for large IT operations teams that ingests alerts from many monitoring tools, groups related ones into incidents and adds topology and change context. -
Keep Open source alert management tool that pulls alerts from many monitoring sources, deduplicates and correlates them, and runs workflows on them. Acquired by Elastic in 2025. -
Moogsoft AIOps event correlation tool that cuts alert noise by clustering related events into situations. Owned by Dell since 2023 and sold as part of Dell APEX AIOps. -
Prometheus Alertmanager Receives alerts from Prometheus and compatible systems, then groups, deduplicates, silences and routes them to email, Slack, PagerDuty, webhooks and other receivers. -
Robusta Kubernetes alert enrichment and routing on top of Prometheus: adds pod logs, events and graphs to alerts and sends them to Slack, Teams and other sinks. Open source core plus a paid SaaS. -
Versus Incident Self-hosted alert relay that turns webhooks from Alertmanager, Grafana, Sentry and others into templated messages for Slack, Teams, Telegram and email, escalating to on-call tools if unacknowledged. - karma Dashboard for Prometheus Alertmanager that combines alerts from several Alertmanager instances, groups them and makes silences easy to manage.