# Create a custom dashboard on elastic alerting data

**URL:** <https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [December 16, 2025, 10:15am UTC](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108 "2025-12-16T10:15:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Maretti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maretti/32/118976_2.png) [@Maretti](https://discuss.elastic.co/u/Maretti)\
**Post date:** [December 16, 2025, 10:15am UTC](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108/1 "2025-12-16T10:15:36Z")

</div>

Hi, I would like to create a dashboard with the data from elastic alerting.

According to this documentation page the data is visible under .internal-alerts-\* indices

> **[Query alert indices | Elastic Docs](https://www.elastic.co/docs/solutions/security/detect-and-alert/query-alert-indices)**
>
> This page explains how you should query alert indices, for example, when building rule queries, custom dashboards, or visualizations. For more information...

I can see those in index management  
ex. .internal.alerts-default.alerts-default-000001

But I can’t make a dataview covering these indices is there a way to do this or is this not supported?

---

<div class="post-metadata">

**Author:** ![Maretti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maretti/32/118976_2.png) [@Maretti](https://discuss.elastic.co/u/Maretti)\
**Post date:** [December 16, 2025, 10:26am UTC](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108/2 "2025-12-16T10:26:38Z")

</div>

Found the solution I had to enable system and hidden indices when creating the dataview under advanced settings

---

<div class="post-metadata">

**Author:** ![umbo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umbo/32/146339_2.png) [@umbo](https://discuss.elastic.co/u/umbo)\
**Post date:** [December 16, 2025, 11:15am UTC](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108/3 "2025-12-16T11:15:59Z")

</div>

Hey @Maretti!

As the documentation explains, alert indices are system/hidden indices, so use with caution! I’d suggest using the `.alerts-*` aliases instead of the corresponding `.internal.alerts-*` indices directly. If you need to query specific rule types, you can do so using the `kibana.alert.rule.rule_type_id` field in alert documents.

However if you only need to display alerts in your dashboards without complex queries, consider using the [Alerts](https://www.elastic.co/docs/explore-analyze/visualize/alert-panels) panel: it displays an alerts table you can filter by Solution, rule type and rule tags.

Hope this helps! 🙂